Cross-source coverage
T1686.003 / ATT&CK
Disable or Modify System Firewall: Windows Host Firewall
20 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.
Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., netsh advfirewall or PowerShell cmdlets like Set-NetFirewallProfile, New-NetFirewallRule), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.
By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
- Tactics
- Defense Impairment
- Platforms
- Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:System
How MITRE says to detect it DET0901
Detect Windows Firewall
Windows Analytic 2043
Detects processes or users modifying Windows Defender Firewall profiles, policies, or rules followed by measurable network exposure changes. Correlates firewall management execution, registry/policy mutation, service state changes, and subsequent inbound or outbound connectivity inconsistent with baseline administration.
WinEventLog:SysmonEventCode=1WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=13, 14WinEventLog:SysmonEventCode=12WinEventLog:SystemEventCode=7036WinEventLog:SysmonEventCode=3, 22WinEventLog:SecurityEventCode=5156, 5157
SigmaHQ/sigma
20 rules| Detection | Severity | Format |
|---|---|---|
| All Rules Have Been Deleted From The Windows Firewall Configuration | High | Sigma |
| New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application | High | Sigma |
| RDP Connection Allowed Via Netsh.EXE | High | Sigma |
| Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE | High | Sigma |
| A Rule Has Been Deleted From The Windows Firewall Exception List | Medium | Sigma |
| Disable Microsoft Defender Firewall via Registry | Medium | Sigma |
| Disable Windows Firewall by Registry | Medium | Sigma |
| Firewall Disabled via Netsh.EXE | Medium | Sigma |
| Firewall Rule Deleted Via Netsh.EXE | Medium | Sigma |
| Netsh Allow Group Policy on Microsoft Defender Firewall | Medium | Sigma |
+ 10 more from SigmaHQ/sigma → showing the 10 highest-severity