1200KM / detection
T1686.002 Network Device Firewall — Detection Rules
Detection workspace for T1686.002 Network Device Firewall: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0306 Detection of Unauthorized Network Firewall Rule Modification
AN0855 Analytic 0855
Defender observes configuration changes on firewall/network appliance involving rule creation, modification, or deletion from abnormal management IPs or non-console channels (e.g., remote CLI, API). These are often correlated with a spike in previously blocked outbound traffic, unexpected allow-all rules, or bulk rule deletions. Behavior often follows unauthorized login, privilege escalation, or API abuse.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1686.002 simulation workspace
- Command Execution · DC0064
- Firewall Rule Modification · DC0051
- Logon Session Creation · DC0067
- Network Connection Creation · DC0082
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.