{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1686","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"d54b657763deba6354c434fc9c6060dfdd94eb7259928822181c573f34adc514","description":"Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti)\n\nAdversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1686","external_id":"T1686"},{"source_name":"Broadcom ESXi Firewall","description":"Broadcom. (2025, March 24). Add Allowed IP Addresses for an ESXi Host by Using the VMware Host Client. Retrieved March 26, 2025.","url":"https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/add-allowed-ip-addresses-for-an-esxi-host-by-using-the-vmware-host-client.html"},{"source_name":"Trellix Rnasomhouse 2024","description":"Pham Duy Phuc, Max Kersten, Noël Keijzer, and Michaël Schrijver. (2024, February 14). RansomHouse am See. Retrieved March 26, 2025.","url":"https://www.trellix.com/en-au/blogs/research/ransomhouse-am-see/"},{"source_name":"change_rdp_port_conti","description":"The DFIR Report. (2022, March 1). \"Change RDP port\" #ContiLeaks. Retrieved September 12, 2024.","url":"https://x.com/TheDFIRReport/status/1498657772254240768"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1686.001","id":"T1686.001","name":"Cloud Firewall","page":"techniques/enterprise/T1686.001/"},{"key":"enterprise/T1686.002","id":"T1686.002","name":"Network Device Firewall","page":"techniques/enterprise/T1686.002/"},{"key":"enterprise/T1686.003","id":"T1686.003","name":"Windows Host Firewall","page":"techniques/enterprise/T1686.003/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0051","name":"Firewall Rule Modification","page":"telemetry/DC0051/","kind":"attack_component","category":"Windows and directory audit","description":"Changes to firewall rules and their matching/action criteria.","collection_focus":"Collect firewall policy audit plus before/after rule snapshots; identify local versus centrally managed policy and the responsible administrator.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["rule_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0051","collector":"illustrative-lab-collector","observation":{"rule_id":"lab-rule-1","attribute":"remote_address","before":"192.0.2.10","after":"192.0.2.11"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1686","technique_page":"techniques/enterprise/T1686/","page":"detections/enterprise/T1686/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"70b4156e-50fc-4523-aa50-c9dddf1993fc","title":"Bpfdoor TCP Ports Redirect","status":"test","level":"medium","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/70b4156e-50fc-4523-aa50-c9dddf1993fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml","author":"Rafal Piasecki","kind":"sigma"},{"id":"323ff3f5-0013-4847-bbd4-250b5edb62cc","title":"Modify System Firewall","status":"test","level":"medium","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/323ff3f5-0013-4847-bbd4-250b5edb62cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml","author":"IAI","kind":"sigma"},{"id":"53059bc0-1472-438b-956a-7508a94a91f0","title":"Disable System Firewall","status":"test","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/53059bc0-1472-438b-956a-7508a94a91f0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/service_stop/lnx_auditd_disable_system_firewall.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"49f5dfc1-f92e-4d34-96fa-feba3f6acf36","title":"Disabling Security Tools - Builtin","status":"test","level":"medium","logsource":{"product":"linux","service":"syslog"},"data_path":"data/detection-rules/49f5dfc1-f92e-4d34-96fa-feba3f6acf36.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml","author":"Ömer Günal, Alejandro Ortuno, oscd.community","kind":"sigma"},{"id":"84c9e83c-599a-458a-a0cb-0ecce44e807a","title":"UFW Disable Attempt","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/84c9e83c-599a-458a-a0cb-0ecce44e807a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"3be619f4-d9ec-4ea8-a173-18fdd01996ab","title":"Flush Iptables Ufw Chain","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/3be619f4-d9ec-4ea8-a173-18fdd01996ab.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"e3a8a052-111f-4606-9aee-f28ebeb76776","title":"Disabling Security Tools","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/e3a8a052-111f-4606-9aee-f28ebeb76776.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml","author":"Ömer Günal, Alejandro Ortuno, oscd.community","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0145","name":"Detection of Disabled or Modified System Firewalls across OS Platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0145","stix_id":"x-mitre-detection-strategy--acb9a314-aa08-4a0f-b3ba-201d87fa4cc8","relationship_id":"relationship--c927755f-1c4c-4cf2-a6bb-b043ef0ef2f4","description":"","analytics":[{"id":"AN0406","name":"Analytic 0406","guidance":"Detection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy also indicate adversarial actions.","url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0406","platforms":["Windows"],"tuning":[{"field":"MonitoredCommands","description":"List of admin tools and scripts allowed to legitimately modify firewall settings."},{"field":"AlertThreshold","description":"Number of firewall rule changes within a time window before triggering alert."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0406","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0406","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0406","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0406","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN0407","name":"Analytic 0407","guidance":"Detection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.","url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0407","platforms":["Linux"],"tuning":[{"field":"AllowedScripts","description":"Baseline admin scripts allowed to make firewall modifications."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve: iptables, nft, firewall-cmd modifications","platforms":["Linux"],"analytic_id":"AN0407","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0407","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:osquery","channel":"execution of known firewall binaries","platforms":["Linux"],"analytic_id":"AN0407","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0407","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0408","name":"Analytic 0408","guidance":"Detection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.","url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0408","platforms":["macOS"],"tuning":[{"field":"PFConfigFiles","description":"Monitor for baseline pf.conf and custom rule file modifications."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf","platforms":["macOS"],"analytic_id":"AN0408","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0408","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0409","name":"Analytic 0409","guidance":"Detection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.","url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0409","platforms":["ESXi"],"tuning":[{"field":"APIMethods","description":"Whitelist of authorized vSphere API methods for firewall configuration."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:hostd","channel":"esxcli network firewall set commands","platforms":["ESXi"],"analytic_id":"AN0409","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0409","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0051","component":"Firewall Rule Modification","name":"esxi:hostd","channel":"vSphere API calls modifying firewall settings","platforms":["ESXi"],"analytic_id":"AN0409","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0409","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0051/"}]},{"id":"AN0410","name":"Analytic 0410","guidance":"Detection of firewall ACL or rule base changes through CLI (e.g., no access-list, permit any any). Monitor configuration commits from unusual users or sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0410","platforms":["Network Devices"],"tuning":[{"field":"AuthorizedAdmins","description":"List of approved admin accounts allowed to modify firewall ACLs."}],"log_sources":[{"component_id":"DC0051","component":"Firewall Rule Modification","name":"networkdevice:cli","channel":"firewall disable commands or suspicious ACL modifications","platforms":["Network Devices"],"analytic_id":"AN0410","source_url":"https://attack.mitre.org/detectionstrategies/DET0145#AN0410","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0051/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0051","name":"Firewall Rule Modification","tag":"Firewall Rule Modification","page":"telemetry/DC0051/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0108","name":"netsh","page":"tools/S0108/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0108","name":"netsh","page":"tools/S0108/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has modified local firewall rules on victim machines to enable a random, high-number listening port for subsequent access and C2 activity.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--80e9ec9c-ecb4-48c3-944c-e318fec4a656","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"The \"ZR\" variant of [BACKSPACE](https://attack.mitre.org/software/S0031) will check to see if known host-based firewalls are installed on the infected systems. [BACKSPACE](https://attack.mitre.org/software/S0031) will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.(Citation: FireEye APT30)","relationship_id":"relationship--c45026a7-dbe4-4ea6-946d-abb66a78f4d6","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0088","name":"Kasidet","url":"https://attack.mitre.org/software/S0088","kind":"malware","description":"[Kasidet](https://attack.mitre.org/software/S0088) has the ability to change firewall settings to allow a plug-in to be downloaded.(Citation: Zscaler Kasidet)","relationship_id":"relationship--7b448393-a3d5-4a2e-b96f-591653438eab","references":[{"source_name":"Zscaler Kasidet","description":"Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}]},{"id":"S0108","name":"netsh","url":"https://attack.mitre.org/software/S0108","kind":"tool","description":"[netsh](https://attack.mitre.org/software/S0108) can be used to disable local firewall settings.(Citation: TechNet Netsh)(Citation: TechNet Netsh Firewall)","relationship_id":"relationship--35edfce6-c395-4dcd-b5be-848860f68d23","references":[{"source_name":"TechNet Netsh","description":"Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.","url":"https://technet.microsoft.com/library/bb490939.aspx"},{"source_name":"TechNet Netsh Firewall","description":"Microsoft. (2009, June 3). Netsh Commands for Windows Firewall. Retrieved April 20, 2016.","url":"https://technet.microsoft.com/en-us/library/cc771046(v=ws.10).aspx"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) has a command to disable routing and the Firewall on the victim’s machine.(Citation: ESET InvisiMole June 2018)","relationship_id":"relationship--04d0ffea-293c-4660-9735-87419349132e","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}]},{"id":"S0336","name":"NanoCore","url":"https://attack.mitre.org/software/S0336","kind":"malware","description":"[NanoCore](https://attack.mitre.org/software/S0336) can modify the victim's firewall.(Citation: DigiTrust NanoCore Jan 2017)(Citation: PaloAlto NanoCore Feb 2016)","relationship_id":"relationship--86b724dd-09f8-4182-adff-08ba6e391747","references":[{"source_name":"DigiTrust NanoCore Jan 2017","description":"The DigiTrust Group. (2017, January 01). NanoCore Is Not Your Average RAT. Retrieved November 9, 2018.","url":"https://www.digitrustgroup.com/nanocore-not-your-average-rat/"},{"source_name":"PaloAlto NanoCore Feb 2016","description":"Kasza, A., Halfpop, T. (2016, February 09). NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has modified the firewall using [netsh](https://attack.mitre.org/software/S0108).(Citation: US-CERT HOPLIGHT Apr 2019)\t","relationship_id":"relationship--4c17948b-96f6-4f0f-ac37-7393ea5d832b","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can disable the firewall by modifying the registry key <code>HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile</code>.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--a49751ab-abbb-414f-926e-97c7fa3da30c","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0492","name":"CookieMiner","url":"https://attack.mitre.org/software/S0492","kind":"malware","description":"[CookieMiner](https://attack.mitre.org/software/S0492) has checked for the presence of \"Little Snitch\", macOS network monitoring and application firewall software, stopping and exiting if it is found.(Citation: Unit42 CookieMiner Jan 2019)","relationship_id":"relationship--4dbfc708-e582-4e7e-997f-b8d5843ee28b","references":[{"source_name":"Unit42 CookieMiner Jan 2019","description":"Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--f0690af9-5784-4f63-983a-a6d8747f9d32","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S1032","name":"PyDCrypt","url":"https://attack.mitre.org/software/S1032","kind":"malware","description":"[PyDCrypt](https://attack.mitre.org/software/S1032) has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using `netsh.exe` on remote machines.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--627388f8-3e1a-4146-af0b-5dffacafdfa2","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1161","name":"BPFDoor","url":"https://attack.mitre.org/software/S1161","kind":"malware","description":"[BPFDoor](https://attack.mitre.org/software/S1161) starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local `iptables` rules to redirect all packets from the attacker to the shell port.(Citation: Sandfly BPFDoor 2022) ","relationship_id":"relationship--ad269937-6339-4686-8f3b-369e0c65afc6","references":[{"source_name":"Sandfly BPFDoor 2022","description":"The Sandfly Security Team. (2022, May 11). BPFDoor - An Evasive Linux Backdoor Technical Analysis. Retrieved September 29, 2023.","url":"https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) turns on the system firewall and deletes all of its rules during execution.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--cef26a74-8a95-4f9d-8a60-3da9fc452725","references":[{"source_name":"Kaspersky ShrinkLocker 2024","description":"Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024.","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1211","name":"Hannotog","url":"https://attack.mitre.org/software/S1211","kind":"malware","description":"[Hannotog](https://attack.mitre.org/software/S1211) can modify local firewall settings via `netsh` commands to open a listening UDP port.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--7b7fbbfe-60e0-44b2-87ea-d3488548f8b3","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"S1223","name":"THINCRUST","url":"https://attack.mitre.org/software/S1223","kind":"malware","description":"[THINCRUST](https://attack.mitre.org/software/S1223) can use the Django python module \"django.views.decorators.csrf” along with the decorator “csrf_exempt” within victim firewalls to disable cross-site request forgery protections.(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--0f6eec8a-8c53-4d38-bf41-37b92358e158","references":[{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]}],"actors":[{"id":"G0008","name":"Carbanak","url":"https://attack.mitre.org/groups/G0008","kind":"intrusion-set","description":"[Carbanak](https://attack.mitre.org/groups/G0008) may use [netsh](https://attack.mitre.org/software/S0108) to add local firewall rule exceptions.(Citation: Group-IB Anunak)","relationship_id":"relationship--c8eec284-ab05-48a5-b79e-412db42f7123","references":[{"source_name":"Group-IB Anunak","description":"Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016.","url":"http://www.group-ib.com/files/Anunak_APT_against_financial_institutions.pdf"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has disabled host-based firewalls. The group has also globally opened port 3389.(Citation: US-CERT TA18-074A)","relationship_id":"relationship--914014ba-ee7d-46da-ab51-609c1f67dec0","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has added a firewall rule to allow TCP port 59999 inbound and a rule to allow sshd.exe on TCP port 9898.(Citation: BlackBerry_FIN7_April2024)  ","relationship_id":"relationship--83ce1f0c-8afc-472d-af07-71b359d7781b","references":[{"source_name":"BlackBerry_FIN7_April2024","description":" The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025.","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.(Citation: CISA AA20-239A BeagleBoyz August 2020)","relationship_id":"relationship--715428e2-873b-4345-b61d-8d72390cab01","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has been observed disabling the system firewall.(Citation: Securelist Kimsuky Sept 2013)","relationship_id":"relationship--9341533c-bf26-4ca0-9273-7e7f57b5bff6","references":[{"source_name":"Securelist Kimsuky Sept 2013","description":"Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.(Citation: Talos Rocke August 2018)\t","relationship_id":"relationship--bfb5e752-4fc0-44c8-91a5-58a9d70119f0","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has disabled <code>iptables</code>.(Citation: Aqua TeamTNT August 2020)","relationship_id":"relationship--015f32b7-d24e-4562-851a-c7b829e2b128","references":[{"source_name":"Aqua TeamTNT August 2020","description":"Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021.","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"Prior to executing a backdoor [ToddyCat](https://attack.mitre.org/groups/G1022)  has run `cmd /c start /b netsh advfirewall firewall add rule name=\"SGAccessInboundRule\" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--07442853-5df4-425b-98cb-be22df646b43","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) modified firewall rules on victim machines to enable remote system discovery.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)","relationship_id":"relationship--10b52204-b034-4f79-b64c-3a01426221d5","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Symantec BlackByte 2022","description":"Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.(Citation: Cisco Salt Typhoon FEB 2025)","relationship_id":"relationship--c417a3d9-5a49-426d-be92-3763915fd370","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) modified system firewall settings during [PlugX](https://attack.mitre.org/software/S0013) installation using `netsh.exe` to open a listening, random high number port on victim devices.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--4d91bd80-37e8-401d-8ff6-79b968cebbad","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":" [UNC3886](https://attack.mitre.org/groups/G1048) has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--d1c4e56d-8738-4f8b-ac06-5db3877abac8","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","description":"Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"},{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized [PsExec](https://attack.mitre.org/software/S0029) to execute batch scripts that modify firewall settings.(Citation: CISA Medusa Group Medusa Ransomware March 2025)  [Medusa Group](https://attack.mitre.org/groups/G1051) has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--4ee52edf-aa8a-40e1-a9ab-532724d17224","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.","relationship_id":"relationship--66bcb598-3414-4e4f-b17e-f835daa7f803","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.","relationship_id":"relationship--4e4fdef4-b0a4-4899-849e-2e16af6a95f3","references":[]},{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.","relationship_id":"relationship--283bdd31-247b-47aa-886b-66db5ca13eff","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls.","relationship_id":"relationship--2496b1fe-0a73-4918-82e6-7f2a07c44353","references":[]}],"candidates":[{"id":"0ca82ed1-0a94-4774-9a9a-a2c83a8022b7","name":"Stop/Start Packet Filter","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Stop the Packet Filter if installed.\n","inputs":{},"dependencies":[{"description":"Check if pfctl is installed on the machine.\n"}],"source_definition_sha256":"74a2a4c3904cd1c0966cd096eb962ce0dbc254e0f08cc0257d4244965bde4bdc"},{"id":"15e57006-79dd-46df-9bf9-31bc24fb5a80","name":"Opening ports for proxy - HARDRAIN","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.\n\nreference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf\n","inputs":{},"dependencies":[],"source_definition_sha256":"73c3808091d7920a35507c001520b7bf04c7943da1e2986d0e7d7d0f64bae577"},{"id":"419cca0c-fa52-4572-b0d7-bc7c6f388a27","name":"Tail the UFW firewall log file","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Print  the last 10 lines of the Uncomplicated Firewall (UFW) log file \n/var/log/ufw.log.\n","inputs":{},"dependencies":[{"description":"Check if /var/log/ufw.log exists.\n"}],"source_definition_sha256":"3bddc52f60f4ec5afdf581b0ce23db06985c05dc10bc7df993a279d7abd34e88"},{"id":"6f5822d2-d38d-4f48-9bfc-916607ff6b8c","name":"Allow Executable Through Firewall Located in Non-Standard Location","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"This test will attempt to allow an executable through the system firewall located in the Users directory","inputs":{"exe_file_path":{"description":"path to exe file","type":"path","default":"PathToAtomicsFolder\\T1686\\bin\\AtomicTest.exe"}},"dependencies":[],"source_definition_sha256":"130497b47fcfe265ae74cfbb5cf8efba8ac5f8d1d7050ad1482f1377e92c00e5"},{"id":"7784c64e-ed0b-4b65-bf63-c86db229fd56","name":"Disable iptables","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Some Linux systems may not activate ufw, but use iptables for firewall rules instead. (ufw works on top of iptables.) \nAttackers cannot directly disable iptables, as it is not implemented as a service like ufw. But they can flush all iptables \nrules, which in fact \"disable\" iptables. \n","inputs":{},"dependencies":[{"description":"Check if iptables is installed on the machine.\n"}],"source_definition_sha256":"b740e7257ae957954955fb8a88cd21278a38adfa2f6097930340ede5ff60dc2e"},{"id":"7b697ece-8270-46b5-bbc7-6b9e27081831","name":"Edit UFW firewall main configuration file","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Edit the Uncomplicated Firewall (UFW) main configuration file for setting \ndefault policies /etc/default/ufw.\n","inputs":{},"dependencies":[{"description":"Check if /etc/default/ufw exists.\n"}],"source_definition_sha256":"613e94081a098eb4d79e82a9048f6bff3d7005bbc4ec596e8aa08dbd385baa33"},{"id":"80b453d1-eec5-4144-bf08-613a6c3ffe12","name":"LockBit Black - Unusual Windows firewall registry modification -Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"An adversary tries to modify the windows firewall registry.\n","inputs":{},"dependencies":[],"source_definition_sha256":"55ea7616610b93736a926cd18aa6f0d0639d52ce9315b6ca5c0b583bf8bccb8e"},{"id":"88d05800-a5e4-407e-9b53-ece4174f197f","name":"Disable Microsoft Defender Firewall","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Disables the Microsoft Defender Firewall for the current profile.\nCaution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...\n","inputs":{},"dependencies":[],"source_definition_sha256":"bb74ae4570fc47c415f348fce766b81abba3516f2f89080a6ced76bd3b0f6382"},{"id":"899a7fb5-d197-4951-8614-f19ac4a73ad4","name":"Modify/delete iptables firewall rules","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Instead of completely \"disabling\" iptables, adversaries may choose to delete a certain rule, which, for example, blocks data exfiltration via ftp.\nBy doing so, they may cause less noise to avoid detection. \n","inputs":{},"dependencies":[{"description":"Check if iptables is installed on the machine.\n"}],"source_definition_sha256":"54941e71274c72c69e0450cb98a36ace3a6ae4d86058db423688eefe69f08cf9"},{"id":"8a95b832-2c2a-494d-9cb0-dc9dd97c8bad","name":"Turn off UFW logging","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Turn off the Uncomplicated Firewall (UFW) logging. \n","inputs":{},"dependencies":[{"description":"Check if ufw is installed on the machine and enabled.\n"}],"source_definition_sha256":"2e59c0dd142538a6602b9fc6ab5165acb56a094e66e3ce6735b60d295b708cc1"},{"id":"8b23cae1-66c1-41c5-b79d-e095b6098b5b","name":"Add and delete Packet Filter rules","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Add and delete a rule on the Packet Filter (PF) if installed and enabled. \n","inputs":{},"dependencies":[{"description":"Check if pf is installed on the machine and enabled.\n"}],"source_definition_sha256":"c96673eb484a80a5f9c5d51d08ad0d0d8668c1e298b9c51fb5fb3c339276cd78"},{"id":"91f348e6-3760-4997-a93b-2ceee7f254ee","name":"Blackbit - Disable Windows Firewall using netsh firewall","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"An adversary tries to modify the windows firewall configuration using the deprecated netsh firewall command (command still works).     \n","inputs":{},"dependencies":[],"source_definition_sha256":"ea7411a47b5e7085f69c774d3670866f9d5e4bd65584206bff1f03e155091cee"},{"id":"94be7646-25f6-467e-af23-585fb13000c8","name":"Set a firewall rule using New-NetFirewallRule","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"This test will attempt to create a new inbound/outbound firewall rule using the New-NetFirewallRule commandlet.","inputs":{"direction":{"description":"Direction can be Inbound or Outbound","type":"string","default":"Inbound"},"local_port":{"description":"This is the local port you wish to test opening","type":"integer","default":21},"protocol":{"description":"This is the protocol","type":"string","default":"TCP"},"action":{"description":"This is the action","type":"string","default":"allow"}},"dependencies":[],"source_definition_sha256":"d1a6eed7ea608cb917b0ceaeceadbfb3e9a37325cfbf588e00901ad0848ddb5e"},{"id":"9636dd6e-7599-40d2-8eee-ac16434f35ed","name":"Open a local port through Windows Firewall to any profile","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"This test will attempt to open a local port defined by input arguments to any profile","inputs":{"local_port":{"description":"This is the local port you wish to test opening","type":"integer","default":3389}},"dependencies":[],"source_definition_sha256":"34f6730fe5840bc8fca44a777c7cb92873127cf5d282738ba506de8c730668b1"},{"id":"9fd99609-1854-4f3c-b47b-97d9a5972bd1","name":"Stop/Start UFW firewall systemctl","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Stop the Uncomplicated Firewall (UFW) if installed, using systemctl. \n","inputs":{},"dependencies":[{"description":"Check if systemctl and ufw is installed on the machine.\n"}],"source_definition_sha256":"a31ba2642f097cdaf397c42c7fd67db2c48fa16ea86f1f9f4d429bbce4848039"},{"id":"a4651931-ebbb-4cde-9363-ddf3d66214cb","name":"LockBit Black - Unusual Windows firewall registry modification -cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"An adversary tries to modify the windows firewall registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"5bbf7c009b89d4253c987b987fb7b71f9d741d657d28a567fff96c0a6e085007"},{"id":"a67e8aea-ea7c-4c3b-9b1b-8c2957c3091d","name":"ESXi - Set Firewall to PASS Traffic","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"This test sets the default ESXi firewall action to PASS instead of DROP. This allows all incoming and outgoing traffic.\n","inputs":{"vm_host":{"description":"Specify the host name or IP of the ESXi server.","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on the ESXi server.","type":"string","default":"root"},"vm_pass":{"description":"Specify the privileged user's password.","type":"string","default":"password"},"plink_file":{"description":"Path to Plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"}},"dependencies":[{"description":"The plink executable must be found in the ExternalPayloads folder.\n"}],"source_definition_sha256":"2886b4a523ad06f364fc5d36840c7ae18c0f7465c4d29bab27f88ead6b5e06d0"},{"id":"afedc8c4-038c-4d82-b3e5-623a95f8a612","name":"Disable Microsoft Defender Firewall via Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Disables the Microsoft Defender Firewall for the public profile via registry\nCaution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...\n","inputs":{},"dependencies":[],"source_definition_sha256":"299956e6304877fa9569ab6ac63207d6553e025e26ede7d7855134cf6715cf0a"},{"id":"b2563a4e-c4b8-429c-8d47-d5bcb227ba7a","name":"Add and delete UFW firewall rules","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled. \n","inputs":{},"dependencies":[{"description":"Check if ufw is installed on the machine and enabled.\n"}],"source_definition_sha256":"870da0956f114f193b7f94c16cc50572f5ab40c76360c964fdddd3a7af1243df"},{"id":"bac8a340-be64-4491-a0cc-0985cb227f5a","name":"ESXi - Disable Firewall via Esxcli","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Adversaries may disable the ESXI firewall via ESXCLI\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"plink_file":{"description":"Path to Putty","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"username":{"description":"username used to log into ESXi","type":"string","default":"root"},"password":{"description":"password used to log into ESXI","type":"string","default":"n/a"}},"dependencies":[{"description":"The plink executable must be found in the ExternalPayloads folder.\n"}],"source_definition_sha256":"820c06e85cb1594ceb5ac9f7f9477fe2bae9428dd1f00f92ddabb4986a1c4a92"},{"id":"beaf815a-c883-4194-97e9-fdbbb2bbdd7c","name":"Edit UFW firewall user.rules file","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.\n","inputs":{},"dependencies":[{"description":"Check if /etc/ufw/user.rules exists.\n"}],"source_definition_sha256":"7be10083e4f9cb27faa2eeb1782b20dbb864eaee70d3eb5b1574949e74ee5bc8"},{"id":"c1d8c4eb-88da-4927-ae97-c7c25893803b","name":"Edit UFW firewall ufw.conf file","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf \nwhich controls if the firewall starts on boot and its logging level.\n","inputs":{},"dependencies":[{"description":"Check if /etc/ufw/ufw.conf exists.\n"}],"source_definition_sha256":"c76b7460bf3ecd7d05e2e06e25d62a695358972455e3976b5559fa8fc0da20dc"},{"id":"c4ae0701-88d3-4cd8-8bce-4801ed9f97e4","name":"Edit UFW firewall sysctl.conf file","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Edit the Uncomplicated Firewall (UFW) configuration file for setting network \nvariables /etc/ufw/sysctl.conf.\n","inputs":{},"dependencies":[{"description":"Check if /etc/ufw/sysctl.conf exists.\n"}],"source_definition_sha256":"8d1866b11e219e213a5caccddd959df1d09f63b4b16434e38812b7cd99a7be32"},{"id":"d9841bf8-f161-4c73-81e9-fd773a5ff8c1","name":"Allow SMB and RDP on Microsoft Defender Firewall","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.\nCaution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...\n","inputs":{},"dependencies":[],"source_definition_sha256":"0d2ea6ab4da89dc6da64a7101414214236e58eb2c33e4ce3e25e6a82460739fd"},{"id":"fe135572-edcd-49a2-afe6-1d39521c5a9a","name":"Stop/Start UFW firewall","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1686/T1686.yaml","description":"Stop the Uncomplicated Firewall (UFW) if installed.\n","inputs":{},"dependencies":[{"description":"Check if ufw is installed on the machine.\n"}],"source_definition_sha256":"722b5aba226e0c4f52656b975298969a5360721ae27aed7a803e8d4b6c674d18"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1686":"/ttp-simulation/techniques/enterprise/T1686/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1686","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0051","collector":"illustrative-lab-collector","observation":{"rule_id":"lab-rule-1","attribute":"remote_address","before":"192.0.2.10","after":"192.0.2.11"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}