T1686.003 Windows Host Firewall

Technique

T1686.003

Tactics

Defense Evasion

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

20

Elastic, Splunk

0

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1686/003

MITRE description

Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface. By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT

Detection coverage

SigmaHQ community rules

• Firewall Rule Modified In The Windows Firewall Exception List (threat-hunting)
• New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock (threat-hunting)
• New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet (threat-hunting)
• New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application (core)
• New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE (core)
• Uncommon New Firewall Rule Added In Windows Firewall Exception List (core)
• All Rules Have Been Deleted From The Windows Firewall Configuration (core)
• A Rule Has Been Deleted From The Windows Firewall Exception List (core)
• The Windows Defender Firewall Service Failed To Load Group Policy (core)
• Windows Defender Firewall Has Been Reset To Its Default Configuration (core)
• Windows Firewall Settings Have Been Changed (core)
• Windows Firewall Profile Disabled (core)
• New Firewall Rule Added Via Netsh.EXE (core)
• Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE (core)
• RDP Connection Allowed Via Netsh.EXE (core)
• Firewall Rule Deleted Via Netsh.EXE (core)
• Firewall Disabled via Netsh.EXE (core)
• Netsh Allow Group Policy on Microsoft Defender Firewall (core)
• Disable Microsoft Defender Firewall via Registry (core)
• Disable Windows Firewall by Registry (core)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.