McAfee ePO - Firewall disabled

Back


Id	bd3cedc3-efba-455a-85bd-0cf9ac1b0727
Rulename	McAfee ePO - Firewall disabled
Description	Detects when firewall was disabled from Mctray.
Severity	Medium
Tactics	DefenseEvasion CommandAndControl
Techniques	T1562 T1071
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOFirewallDisabled.yaml
Version	1.0.2
Arm template	bd3cedc3-efba-455a-85bd-0cf9ac1b0727.json

KQL

McAfeeEPOEvent
| where EventId in ('35009')
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

YAML

relevantTechniques:
- T1562
- T1071
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
triggerThreshold: 0
description: |
    'Detects when firewall was disabled from Mctray.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOFirewallDisabled.yaml
id: bd3cedc3-efba-455a-85bd-0cf9ac1b0727
queryFrequency: 1h
query: |
  McAfeeEPOEvent
  | where EventId in ('35009')
  | extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname  
severity: Medium
status: Available
queryPeriod: 1h
name: McAfee ePO - Firewall disabled
tactics:
- DefenseEvasion
- CommandAndControl
kind: Scheduled

ARM