tfMITRE ATT&CK sub-technique

Network Device Firewall T1686.002

sub-technique of T1686 Disable or Modify System Firewall

Tactic: Defense Impairment
Platform: Network Devices
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributors: Marco Pedrinazzi, @pedrinazziM, InTheCyber; Tommaso Tosi, @tosto92, InTheCyber

Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Network Device Firewall MITRE reference T1686.002

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT38G0082 ↗

Have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. 1

created 2019-01-291 referenceaka NICKEL GLADSTONE

All 1 groups for this technique

Offense vs defense T1686.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2025 Q4 · 1 of 1 campaigns plotted

Network Device Firewall detection strategy DET0306

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Unauthorized Network Firewall Rule Modification

Enterprise

1 platform

AN0855 · Network Devices

Defender observes configuration changes on firewall/network appliance involving rule creation, modification, or deletion from abnormal management IPs or non-console channels (e.g., remote CLI, API). These are often correlated with a spike in previously blocked outbound traffic, unexpected allow-all rules, or bulk rule deletions. Behavior often follows unauthorized login, privilege escalation, or API abuse.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firewall Rule ModificationDC0051	networkdevice:Firewall	update_rule: Access control or NAT rule modified or disabled outside maintenance window
Command ExecutionDC0064	networkdevice:Firewall	Audit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config
Logon Session CreationDC0067	networkdevice:Firewall	Login from untrusted IP, or new admin account accessing firewall console/API
Network Connection CreationDC0082	NSM:Flow	Outbound traffic spike through formerly blocked ports/subnets following config change

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TrustedAdminIPs	Allowlisted IPs/subnets where administrative access is expected (e.g., jump box, VPN mgmt)
ConfigChangeWindow	Expected maintenance window (e.g., 02:00–04:00 UTC) to filter benign changes
RuleScopeThreshold	Number of rules affected or port ranges modified to determine severity
NewUserPrivilegeThreshold	Flag new users making changes without observed privilege elevation path

Network Device Firewall detections T1686.002

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs