PacuS1091 ↗
Can allowlist IP addresses in AWS GuardDuty.1
tfMITRE ATT&CK sub-technique
Cloud Firewall T1686.001
sub-technique of T1686 Disable or Modify System Firewall
- Tactic
- Defense Impairment
- Platform
- IaaS
- Version
- 1.0
- Created
- 14 April 2026
- Last modified
- 12 May 2026
- Contributors
- Arun Seelagan, CISA; Expel
Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Cloud Firewall MITRE reference T1686.001
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1686.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 7
first rule: 2020 Q2Cloud Firewall detection strategy DET0424
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Disable or Modify Cloud Firewall
1 platform
AN1188 · IaaS
Creation, deletion, or modification of security groups and firewall rules in cloud control plane logs that expand access to cloud resources beyond expected baselines. Defender view: unexpected ingress/egress rules permitting 0.0.0.0/0 or opening atypical ports, often correlated with privileged role or API key activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firewall DisableDC0043 | AWS:CloudTrail | Removal of restrictive egress rules from a security group |
| Firewall Rule ModificationDC0051 | AWS:CloudTrail | Ingress rule creation or modification for security group |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedIPRanges | Whitelist approved IP ranges; detect unexpected addition of 0.0.0.0/0 or untrusted CIDRs. |
| PortScope | Define expected ports for services; flag additions outside this range (e.g., SSH/RDP open to all). |
| RoleContext | Tune alerts based on whether changes are made by break-glass or admin roles versus automation accounts. |
| TimeWindow | Correlate rule changes with subsequent suspicious network activity to reduce false positives. |
AuditM1047
Routinely check account role permissions to ensure only expected users and roles have permission to modify cloud firewalls.
Ensure least privilege principles are applied to Identity and Access Management (IAM) security policies.