tfMITRE ATT&CK technique

Disable or Modify System Firewall T1686

Tactic: Defense Impairment
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026

Sub-techniques 352 rules across the family · 18 mapped directly to T1686 · 3 of 3 carry rules

.001Cloud Firewall12 .002Network Device Firewall2 .003Windows Host Firewall20

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 14%

Threat groups86th percentile · 86% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 21%

Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 15%

Detection rules85th percentile · 85% of ATT&CK techniques have this many detection rules written or fewer.

Disable or Modify System Firewall MITRE reference T1686

Top 14%of all ATT&CK techniques for number of groups

13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has utilized PsExec to execute batch scripts that modify firewall settings.1 Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.1

created 2025-10-152 references

UNC3886G1048 ↗

Has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.1 2 3

created 2025-05-293 references

Velvet AntG1047 ↗

Modified system firewall settings during PlugX installation using netsh.exe to open a listening, random high number port on victim devices.1

created 2025-03-141 reference

Salt TyphoonG1045 ↗

Has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.1

created 2025-02-241 reference

BlackByteG1043 ↗

Modified firewall rules on victim machines to enable remote system discovery.1 2

created 2024-12-162 referencesaka Hecamede

ToddyCatG1022 ↗

Prior to executing a backdoor ToddyCat has run cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683 to allow the targeted system to receive UDP packets on port 49683.1

created 2024-01-031 reference

All 13 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Leviathan Australian IntrusionsC0049 ↗

Leviathan modified system firewalls to add two open listening ports on 9998 and 9999 during Leviathan Australian Intrusions.1

2022

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.1

2019–2021

All 2 campaigns for this technique

15 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

THINCRUSTS1223 ↗

Can use the Django python module "django.views.decorators.csrf” along with the decorator “csrf_exempt” within victim firewalls to disable cross-site request forgery protections.1

created 2025-06-16MALWAREcarried by 1 group

HannotogS1211 ↗

Can modify local firewall settings via netsh commands to open a listening UDP port.1

created 2025-03-16MALWAREcarried by 1 group

ShrinkLockerS1178 ↗

Turns on the system firewall and deletes all of its rules during execution.1 2

created 2024-12-07MALWARE

BPFDoorS1161 ↗

Starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local iptables rules to redirect all packets from the attacker to the shell port.1

created 2024-09-20MALWARE

PyDCryptS1032 ↗

Has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using netsh.exe on remote machines.1

created 2022-08-11MALWAREcarried by 1 group

GrandoreiroS0531 ↗

Can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.1

created 2020-11-10MALWARE

All 15 software entries for this technique · 6 newest in this preview

Offense vs defense T1686

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 11

first rule: 2020 Q2 · 2 of 2 campaigns plotted

Disable or Modify System Firewall detection strategy DET0145

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Disabled or Modified System Firewalls across OS Platforms.

Enterprise

5 platforms

AN0406 · Windows

Detection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy also indicate adversarial actions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredCommands	List of admin tools and scripts allowed to legitimately modify firewall settings.
AlertThreshold	Number of firewall rule changes within a time window before triggering alert.

AN0407 · Linux

Detection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:osquery	execution of known firewall binaries
Command ExecutionDC0064	auditd:SYSCALL	execve: iptables, nft, firewall-cmd modifications

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedScripts	Baseline admin scripts allowed to make firewall modifications.

AN0408 · macOS

Detection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	macos:unifiedlog	pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PFConfigFiles	Monitor for baseline pf.conf and custom rule file modifications.

AN0409 · ESXi

Detection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firewall Rule ModificationDC0051	esxi:hostd	vSphere API calls modifying firewall settings
Command ExecutionDC0064	esxi:hostd	esxcli network firewall set commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
APIMethods	Whitelist of authorized vSphere API methods for firewall configuration.

AN0410 · Network Devices

Detection of firewall ACL or rule base changes through CLI (e.g., no access-list, permit any any). Monitor configuration commits from unusual users or sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firewall Rule ModificationDC0051	networkdevice:cli	firewall disable commands or suspicious ACL modifications

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthorizedAdmins	List of approved admin accounts allowed to modify firewall ACLs.

Tests25Executorssh 13 · cmd 8 · PowerShell 4Need elevation20 of 25Have prerequisites15Have cleanup24Platformswindows, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Disable Microsoft Defender Firewall

windows

cmd

—

Yes

Disable Microsoft Defender Firewall via Registry

windows

cmd

—

Yes

Allow SMB and RDP on Microsoft Defender Firewall

windows

cmd

—

Yes

Opening ports for proxy - HARDRAIN

windows

cmd

Required

—

Yes

Open a local port through Windows Firewall to any profile

windows

PowerShell

Required

—

Yes

This test will attempt to open a local port defined by input arguments to any profile

Input arguments

Name	Type	Default	Description
local_port	integer	3389	This is the local port you wish to test opening

Attack command

netsh advfirewall firewall add rule name="Open Port to Any" dir=in protocol=tcp localport=#{local_port} action=allow profile=any

Cleanup command

netsh advfirewall firewall delete rule name="Open Port to Any" | Out-Null

GUID94394e99-2fd6-4506-a6f3-e4d476f31171

Allow Executable Through Firewall Located in Non-Standard Location

windows

PowerShell

Required

—

Yes

This test will attempt to allow an executable through the system firewall located in the Users directory

Input arguments

Name	Type	Default	Description
exe_file_path	path	PathToAtomicsFolder\T1686\bin\AtomicTest.exe	path to exe file

Attack command

Copy-Item "#{exe_file_path}" -Destination "C:\Users\$env:UserName" -Force
netsh advfirewall firewall add rule name="Atomic Test" dir=in action=allow program="C:\Users\$env:UserName\AtomicTest.exe" enable=yes

Cleanup command

netsh advfirewall firewall delete rule name="Atomic Test" | Out-Null
Remove-Item C:\Users\$env:UserName\AtomicTest.exe -ErrorAction Ignore

GUID8c0c0cf8-6d3a-44ea-9117-2264ab526157

Stop/Start UFW firewall

linux

Required

Yes

Stop/Start Packet Filter

linux

Required

Yes

Stop/Start UFW firewall systemctl

linux

Required

Yes

Turn off UFW logging

linux

Required

Yes

Add and delete UFW firewall rules

linux

Required

Yes

Add and delete Packet Filter rules

linux

Required

Yes

Edit UFW firewall user.rules file

linux

Required

Yes

Edit UFW firewall ufw.conf file

linux

Required

Yes

Edit UFW firewall sysctl.conf file

linux

Required

Yes

Edit UFW firewall main configuration file

linux

Required

Yes

Tail the UFW firewall log file

linux

Required

—

Disable iptables

linux

Required

Yes

Modify/delete iptables firewall rules

linux

Required

Yes

LockBit Black - Unusual Windows firewall registry modification -cmd

windows

cmd

Required

—

Yes

LockBit Black - Unusual Windows firewall registry modification -Powershell

windows

PowerShell

Required

—

Yes

Blackbit - Disable Windows Firewall using netsh firewall

windows

cmd

Required

—

Yes

ESXi - Disable Firewall via Esxcli

windows

cmd

—

Yes

Adversaries may disable the ESXI firewall via ESXCLI

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
password	string	n/a	password used to log into ESXI
username	string	root	username used to log into ESXi
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to Putty

Attack command

#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1686\src\esxi_disable_firewall.txt

Cleanup command

#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1686\src\esxi_enable_firewall.txt

Prerequisite

The plink executable must be found in the ExternalPayloads folder.

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUIDb5253e3b-42d9-4a40-8a86-a07d8460c6df

Set a firewall rule using New-NetFirewallRule

windows

PowerShell

Required

—

Yes

This test will attempt to create a new inbound/outbound firewall rule using the New-NetFirewallRule commandlet.

Input arguments

Name	Type	Default	Description
action	string	allow	This is the action
protocol	string	TCP	This is the protocol
direction	string	Inbound	Direction can be Inbound or Outbound
local_port	integer	21	This is the local port you wish to test opening

Attack command

New-NetFirewallRule -DisplayName "New rule" -Direction "#{direction}" -LocalPort "#{local_port}" -Protocol "#{protocol}" -Action "#{action}"

Cleanup command

Remove-NetFirewallRule -DisplayName "New rule"

GUID52cef3b2-b590-4189-9c4b-18ac44511034

ESXi - Set Firewall to PASS Traffic

windows

cmd

—

Yes

This test sets the default ESXi firewall action to PASS instead of DROP. This allows all incoming and outgoing traffic.

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name or IP of the ESXi server.
vm_pass	string	password	Specify the privileged user's password.
vm_user	string	root	Specify the privilege user account on the ESXi server.
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to Plink

Attack command

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli network firewall set --default-action true"

Cleanup command

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli network firewall set --default-action false"

Prerequisite

The plink executable must be found in the ExternalPayloads folder.

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUIDbe2b321a-6914-46f8-8e6f-926ecdb3f652

Tests from Atomic Red Team (MIT licence) · technique definition

Disable or Modify System Firewall detections T1686

18 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 15%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs