Should we only include examples that have direct proof of being used by adversaries? In Mandiant's blog post here: https://cloud.google.com/blog/topics/threat-intelligence/vmware-detection-containment-hardening they note the default behavior of the ESXi firewall is to drop packets but a threat actor could leverage esxcli to set the default behavior to pass packets, essentially disabling the firewall. See network firewall set command here: https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html

I'd like to include this in the project, let me know if that makes sense!