McAfee ePO - Firewall disabled

Back


Id	bd3cedc3-efba-455a-85bd-0cf9ac1b0727
Rulename	McAfee ePO - Firewall disabled
Description	Detects when firewall was disabled from Mctray.
Severity	Medium
Tactics	DefenseEvasion CommandAndControl
Techniques	T1562 T1071
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOFirewallDisabled.yaml
Version	1.0.2
Arm template	bd3cedc3-efba-455a-85bd-0cf9ac1b0727.json

KQL

McAfeeEPOEvent
| where EventId in ('35009')
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

YAML

id: bd3cedc3-efba-455a-85bd-0cf9ac1b0727
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOFirewallDisabled.yaml
status: Available
name: McAfee ePO - Firewall disabled
triggerThreshold: 0
relevantTechniques:
- T1562
- T1071
kind: Scheduled
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
queryPeriod: 1h
triggerOperator: gt
query: |
  McAfeeEPOEvent
  | where EventId in ('35009')
  | extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname  
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
tactics:
- DefenseEvasion
- CommandAndControl
version: 1.0.2
description: |
    'Detects when firewall was disabled from Mctray.'
severity: Medium

ARM