Applied Cybernetics Group
T1686 Disable or Modify System Firewall
- Technique
T1686- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 7
- Elastic, Splunk
- 11
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1686
MITRE description
Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less secure port).(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-21Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Detection coverage
SigmaHQ community rules
- Bpfdoor TCP Ports Redirect (core)
- Modify System Firewall (core)
- Disable System Firewall (core)
- Disabling Security Tools - Builtin (core)
- UFW Disable Attempt (core)
- Flush Iptables Ufw Chain (core)
- Disabling Security Tools (core)
Elastic and Splunk rules
- ESXi Firewall Disabled (splunk)
- Microsoft Intune DeviceManagementConfigurationPolicies (splunk)
- Firewall Allowed Program Enable (splunk)
- Linux Auditd Disable Or Modify System Firewall (splunk)
- Linux Iptables Firewall Modification (splunk)
- Linux Stdout Redirection To Dev Null File (splunk)
- Windows Delete or Modify System Firewall (splunk)
- Windows Firewall Rule Added (splunk)
- Windows Firewall Rule Deletion (splunk)
- Windows Firewall Rule Modification (splunk)
- Windows Modify System Firewall with Notable Process Path (splunk)