Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.[1]
Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.[2][3]
Threat groups86th percentile · 85% of ATT&CK techniques have fewer threat groups attributed.
2
CampaignsTop 17%
Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.
15
Tools & malwareTop 21%
Tools & malware79th percentile · 78% of ATT&CK techniques have fewer tools implementing them.
18
Detection rulesTop 15%
Detection rules85th percentile · 85% of ATT&CK techniques have fewer detection rules written.
Disable or Modify System Firewall MITRE reference T1686
Top 14%of all ATT&CK techniques for number of groups
13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has utilized PsExec to execute batch scripts that modify firewall settings.1Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.1
Prior to executing a backdoor ToddyCat has run cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683 to allow the targeted system to receive UDP packets on port 49683.1
created 2024-01-031 reference
All 13 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During the SolarWinds Compromise, APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.1
2019–2021
All 2 campaigns for this technique
15 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Can use the Django python module "django.views.decorators.csrf” along with the decorator “csrf_exempt” within victim firewalls to disable cross-site request forgery protections.1
Starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local iptables rules to redirect all packets from the attacker to the shell port.1
Disable or Modify System Firewall detection strategy DET0145
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Disabled or Modified System Firewalls across OS Platforms.
Enterprise
5 platforms
AN0406 · Windows
Detection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy also indicate adversarial actions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
MonitoredCommands
List of admin tools and scripts allowed to legitimately modify firewall settings.
AlertThreshold
Number of firewall rule changes within a time window before triggering alert.
AN0407 · Linux
Detection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AllowedScripts
Baseline admin scripts allowed to make firewall modifications.
AN0408 · macOS
Detection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
PFConfigFiles
Monitor for baseline pf.conf and custom rule file modifications.
AN0409 · ESXi
Detection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
APIMethods
Whitelist of authorized vSphere API methods for firewall configuration.
AN0410 · Network Devices
Detection of firewall ACL or rule base changes through CLI (e.g., no access-list, permit any any). Monitor configuration commits from unusual users or sessions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.
Tests25Executorssh 13 · command_prompt 8 · powershell 4Need elevation20 of 25Have prerequisites15Have cleanup24Platformswindows, linux
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Disable Microsoft Defender Firewall
windows
command_prompt
—
—
Yes
Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
Attack Commandsrun with command_prompt
netsh advfirewall set currentprofile state off
Cleanup Commands
netsh advfirewall set currentprofile state on >nul 2>&1
GUID88d05800-a5e4-407e-9b53-ece4174f197f
02
Disable Microsoft Defender Firewall via Registry
windows
command_prompt
—
—
Yes
Disables the Microsoft Defender Firewall for the public profile via registry
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...
Attack Commandsrun with command_prompt
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes
Cleanup Commands
netsh advfirewall reset >nul 2>&1
GUIDd9841bf8-f161-4c73-81e9-fd773a5ff8c1
04
Opening ports for proxy - HARDRAIN
windows
command_prompt
Required
—
Yes
This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.
reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf
Attack Commandsrun with command_promptelevation required (root or admin)
Stop the Uncomplicated Firewall (UFW) if installed.
Attack Commandsrun with shelevation required (root or admin)
ufw disable
Cleanup Commands
ufw enable
ufw status verbose
Dependenciesrun with sh
Description
Check if ufw is installed on the machine.
Check Prereq Commands
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUIDfe135572-edcd-49a2-afe6-1d39521c5a9a
08
Stop/Start Packet Filter
linux
sh
Required
1
Yes
Stop the Packet Filter if installed.
Attack Commandsrun with shelevation required (root or admin)
service pf stop
service pf disable
Cleanup Commands
service pf enable
service pf start
service pf status
Dependenciesrun with sh
Description
Check if pfctl is installed on the machine.
Check Prereq Commands
if [ ! -x "$(command -v pfctl)" ]; then echo -e "\n***** PF NOT installed *****\n"; exit 1; fi
if [ "$(kldstat -n pf)" = "" ]; then echo -e "\n***** PF inactive *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUID0ca82ed1-0a94-4774-9a9a-a2c83a8022b7
09
Stop/Start UFW firewall systemctl
linux
sh
Required
1
Yes
Stop the Uncomplicated Firewall (UFW) if installed, using systemctl.
Attack Commandsrun with shelevation required (root or admin)
systemctl stop ufw
Cleanup Commands
systemctl start ufw
systemctl status ufw
Dependenciesrun with sh
Description
Check if systemctl and ufw is installed on the machine.
Check Prereq Commands
if [ ! -x "$(command -v systemctl)" ]; then echo -e "\n***** systemctl NOT installed *****\n"; exit 1; fi
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUID9fd99609-1854-4f3c-b47b-97d9a5972bd1
10
Turn off UFW logging
linux
sh
Required
1
Yes
Turn off the Uncomplicated Firewall (UFW) logging.
Attack Commandsrun with shelevation required (root or admin)
ufw logging off
Cleanup Commands
ufw logging low
ufw status verbose
Dependenciesrun with sh
Description
Check if ufw is installed on the machine and enabled.
Check Prereq Commands
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUID8a95b832-2c2a-494d-9cb0-dc9dd97c8bad
11
Add and delete UFW firewall rules
linux
sh
Required
1
Yes
Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled.
Attack Commandsrun with shelevation required (root or admin)
Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.
Attack Commandsrun with shelevation required (root or admin)
echo "# THIS IS A COMMENT" >> /etc/ufw/user.rules
grep "# THIS IS A COMMENT" /etc/ufw/user.rules
Cleanup Commands
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/user.rules
Dependenciesrun with sh
Description
Check if /etc/ufw/user.rules exists.
Check Prereq Commands
if [ ! -f "/etc/ufw/user.rules" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUIDbeaf815a-c883-4194-97e9-fdbbb2bbdd7c
14
Edit UFW firewall ufw.conf file
linux
sh
Required
1
Yes
Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf
which controls if the firewall starts on boot and its logging level.
Attack Commandsrun with shelevation required (root or admin)
echo "# THIS IS A COMMENT" >> /etc/ufw/ufw.conf
grep "# THIS IS A COMMENT" /etc/ufw/ufw.conf
Cleanup Commands
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/ufw.conf
cat /etc/ufw/ufw.conf
Dependenciesrun with sh
Description
Check if /etc/ufw/ufw.conf exists.
Check Prereq Commands
if [ ! -f "/etc/ufw/ufw.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUIDc1d8c4eb-88da-4927-ae97-c7c25893803b
15
Edit UFW firewall sysctl.conf file
linux
sh
Required
1
Yes
Edit the Uncomplicated Firewall (UFW) configuration file for setting network
variables /etc/ufw/sysctl.conf.
Attack Commandsrun with shelevation required (root or admin)
echo "# THIS IS A COMMENT" >> /etc/ufw/sysctl.conf
grep "# THIS IS A COMMENT" /etc/ufw/sysctl.conf
Cleanup Commands
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/sysctl.conf
cat /etc/ufw/sysctl.conf
Dependenciesrun with sh
Description
Check if /etc/ufw/sysctl.conf exists.
Check Prereq Commands
if [ ! -f "/etc/ufw/sysctl.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUIDc4ae0701-88d3-4cd8-8bce-4801ed9f97e4
16
Edit UFW firewall main configuration file
linux
sh
Required
1
Yes
Edit the Uncomplicated Firewall (UFW) main configuration file for setting
default policies /etc/default/ufw.
Attack Commandsrun with shelevation required (root or admin)
echo "# THIS IS A COMMENT" >> /etc/default/ufw
grep "# THIS IS A COMMENT" /etc/default/ufw
Cleanup Commands
sed -i 's/# THIS IS A COMMENT//g' /etc/default/ufw
Dependenciesrun with sh
Description
Check if /etc/default/ufw exists.
Check Prereq Commands
if [ ! -f "/etc/default/ufw" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUID7b697ece-8270-46b5-bbc7-6b9e27081831
17
Tail the UFW firewall log file
linux
sh
Required
1
—
Print the last 10 lines of the Uncomplicated Firewall (UFW) log file
/var/log/ufw.log.
Attack Commandsrun with shelevation required (root or admin)
tail /var/log/ufw.log
Dependenciesrun with sh
Description
Check if /var/log/ufw.log exists.
Check Prereq Commands
if [ ! -f "/var/log/ufw.log" ]; then echo -e "\n***** ufw NOT logging *****\n"; exit 1; fi
Get Prereq Commands
echo ""
GUID419cca0c-fa52-4572-b0d7-bc7c6f388a27
18
Disable iptables
linux
sh
Required
1
Yes
Some Linux systems may not activate ufw, but use iptables for firewall rules instead. (ufw works on top of iptables.)
Attackers cannot directly disable iptables, as it is not implemented as a service like ufw. But they can flush all iptables
rules, which in fact "disable" iptables.
Attack Commandsrun with shelevation required (root or admin)
iptables-save > /tmp/iptables.rules
iptables -F
Cleanup Commands
iptables-restore < /tmp/iptables.rules
Dependenciesrun with sh
Description
Check if iptables is installed on the machine.
Check Prereq Commands
if [ ! -x "$(command -v iptables)" ]; then echo -e "\n***** iptables NOT installed *****\n"; exit 1; fi
Get Prereq Commands
sudo apt-get install iptables
GUID7784c64e-ed0b-4b65-bf63-c86db229fd56
19
Modify/delete iptables firewall rules
linux
sh
Required
1
Yes
Instead of completely "disabling" iptables, adversaries may choose to delete a certain rule, which, for example, blocks data exfiltration via ftp.
By doing so, they may cause less noise to avoid detection.
Attack Commandsrun with shelevation required (root or admin)
iptables -D OUTPUT -p tcp --dport 21 -j DROP
Cleanup Commands
iptables-restore < /tmp/iptables.rules
Dependenciesrun with sh
Description
Check if iptables is installed on the machine.
Check Prereq Commands
if [ ! -x "$(command -v iptables)" ]; then echo -e "\n***** iptables NOT installed *****\n"; exit 1; fi
if ! echo "$(iptables -L)" | grep -q "DROP .*dpt:ftp"; then echo -e "\n***** this firewall rule is NOT activated *****\n***** activate it by executing \"iptables -A OUTPUT -p tcp --dport 21 -j DROP\" *****\n"; exit 1; fi
Get Prereq Commands
iptables-save > /tmp/iptables.rules
if echo "$(iptables -L)" | grep -q "DROP .*dpt:ftp"; then echo "Rule found"; else echo "Rule not found. Setting it..."; iptables -A OUTPUT -p tcp --dport 21 -j DROP; fi
GUID899a7fb5-d197-4951-8614-f19ac4a73ad4
20
LockBit Black - Unusual Windows firewall registry modification -cmd
windows
command_prompt
Required
—
Yes
An adversary tries to modify the windows firewall registry
Attack Commandsrun with command_promptelevation required (root or admin)
This detection identifies when the ESXi firewall is disabled or set to permissive mode, which can expose the host to unauthorized access and network-based attacks. (...)
Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. (...)
The following analytic detects suspicious modifications to system firewall rules, specifically allowing execution of applications from notable and potentially malicious file paths. (...)