Cross-source coverage
T1686 / ATT&CK
Disable or Modify System Firewall
52 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.
Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.
- Tactics
- Defense Impairment
- Platforms
- ESXi · Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlogesxi:hostdnetworkdevice:cli
How MITRE says to detect it DET0145
Detection of Disabled or Modified System Firewalls across OS Platforms.
Windows Analytic 0406
Detection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy also indicate adversarial actions.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=13, 14
Linux Analytic 0407
Detection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.
auditd:SYSCALLexecve: iptables, nft, firewall-cmd modificationslinux:osqueryexecution of known firewall binaries
macOS Analytic 0408
Detection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.
macos:unifiedlogpfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf
ESXi Analytic 0409
Detection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.
esxi:hostdesxcli network firewall set commandsesxi:hostdvSphere API calls modifying firewall settings
Network Devices Analytic 0410
Detection of firewall ACL or rule base changes through CLI (e.g., no access-list, permit any any). Monitor configuration commits from unusual users or sessions.
networkdevice:clifirewall disable commands or suspicious ACL modifications
Sub-techniques with coverage
Counted in the 52 above — a rule tagged a sub-technique covers this technique too.
SigmaHQ/sigma
34 rules| Detection | Severity | Format |
|---|---|---|
| All Rules Have Been Deleted From The Windows Firewall Configuration | High | Sigma |
| Disable System Firewall | High | Sigma |
| New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application | High | Sigma |
| RDP Connection Allowed Via Netsh.EXE | High | Sigma |
| Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE | High | Sigma |
| A Rule Has Been Deleted From The Windows Firewall Exception List | Medium | Sigma |
| Azure Firewall Modified or Deleted | Medium | Sigma |
| Azure Firewall Rule Collection Modified or Deleted | Medium | Sigma |
| Azure Network Firewall Policy Modified or Deleted | Medium | Sigma |
| Bpfdoor TCP Ports Redirect | Medium | Sigma |
+ 24 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
18 rules| Detection | Severity | Format |
|---|---|---|
| Allow File And Printing Sharing In Firewall | Undefined | SPL |
| Allow Network Discovery In Firewall | Undefined | SPL |
| ASL AWS Network Access Control List Created with All Open Ports | Undefined | SPL |
| ASL AWS Network Access Control List Deleted | Undefined | SPL |
| AWS Network Access Control List Created with All Open Ports | Undefined | SPL |
| AWS Network Access Control List Deleted | Undefined | SPL |
| ESXi Firewall Disabled | Undefined | SPL |
| Firewall Allowed Program Enable | Undefined | SPL |
| Linux Auditd Disable Or Modify System Firewall | Undefined | SPL |
| Linux Iptables Firewall Modification | Undefined | SPL |
+ 8 more from splunk/security_content → showing the 10 highest-severity