Cross-source coverage
T1686.002 / ATT&CK
Disable or Modify System Firewall: Network Device Firewall
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.
Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement.
Adversaries may obtain access to network device management interfaces via Valid Accounts or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications (Exploit Public-Facing Application).
Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
- Tactics
- Defense Impairment
- Platforms
- Network Devices
- Telemetry
-
networkdevice:FirewallNSM:Flow
How MITRE says to detect it DET0306
Detection of Unauthorized Network Firewall Rule Modification
Network Devices Analytic 0855
Defender observes configuration changes on firewall/network appliance involving rule creation, modification, or deletion from abnormal management IPs or non-console channels (e.g., remote CLI, API). These are often correlated with a spike in previously blocked outbound traffic, unexpected allow-all rules, or bulk rule deletions. Behavior often follows unauthorized login, privilege escalation, or API abuse.
networkdevice:Firewallupdate_rule: Access control or NAT rule modified or disabled outside maintenance windownetworkdevice:FirewallLogin from untrusted IP, or new admin account accessing firewall console/APInetworkdevice:FirewallAudit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear configNSM:FlowOutbound traffic spike through formerly blocked ports/subnets following config change
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| FortiGate - Firewall Address Object Added | Medium | Sigma |
| FortiGate - New Firewall Policy Added | Medium | Sigma |