T1686 Disable or Modify System Firewall — ATT&CK Technique
Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port. Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.
Detection coverage (18)
- Bpfdoor TCP Ports Redirect medium
- Disable System Firewall high
- Modify System Firewall medium
- Disabling Security Tools - Builtin medium
- Ufw Force Stop Using Ufw-Init medium
- Flush Iptables Ufw Chain medium
- Disabling Security Tools medium
- ESXi Firewall Disabled
- Microsoft Intune DeviceManagementConfigurationPolicies
- Firewall Allowed Program Enable
- Linux Auditd Disable Or Modify System Firewall
- Linux Iptables Firewall Modification
- Linux Stdout Redirection To Dev Null File
- Windows Delete or Modify System Firewall
- Windows Firewall Rule Modification
- Windows Firewall Rule Added
- Windows Firewall Rule Deletion
- Windows Modify System Firewall with Notable Process Path
Malware using this technique
- InvisiMole
- THINCRUST
- netsh
- HOPLIGHT
- CookieMiner
- PyDCrypt
- NanoCore
- Kasidet
- Hannotog
- PlugX
- ZxShell
- BPFDoor
- BACKSPACE
- ShrinkLocker
- Grandoreiro