VOID MANTICOREG1055 ↗
Has disabled Windows Defender protections to allow for follow-on activities within the compromised host.1
tfMITRE ATT&CK sub-technique
Windows Host Firewall T1686.003
sub-technique of T1686 Disable or Modify System Firewall
- Tactic
- Defense Impairment
- Platform
- Windows
- Version
- 1.0
- Created
- 14 April 2026
- Last modified
- 12 May 2026
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.9
Tools & malware73rd pct
Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.20
Detection rulesTop 14%
Detection rules86th percentile · 86% of ATT&CK techniques have this many detection rules written or fewer.Windows Host Firewall MITRE reference T1686.003
Top 25%of all ATT&CK techniques for number of groups
6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
MirrorFaceG1054 ↗
Can modify the system firewall to allow communication to certain ports.1
Moses StaffG1009 ↗
Has used batch scripts that can disable the Windows firewall on specific remote machines.1
Magic HoundG0059 ↗
Has added the following rule to a victim's Windows firewall to allow RDP traffic - "netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389.12
OilRigG0049 ↗
Has modified Windows firewall rules to enable remote access.1
Lazarus GroupG0032 ↗
Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. 123
All 6 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim's Windows firewall to set up a series of port-forwards allowing traffic to target systems.1
Operation WocaoC0014 ↗
During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.1
All 2 campaigns for this technique
9 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
HiddenFaceS9023 ↗
Can reconfigure Windows firewalls to enable communication by adding a rule named “Cortana” to allow inbound connection to TCP/47000.12
BlackByte 2.0 RansomwareS1181 ↗
Modifies the Windows firewall during execution.1
njRATS0385 ↗
Has modified the Windows firewall to allow itself to communicate through the firewall.12
DarkCometS0334 ↗
Can disable Security Center functions like the Windows Firewall.12
BADCALLS0245 ↗
Disables the Windows firewall before binding to a port.1
HARDRAINS0246 ↗
Opens the Windows Firewall to modify incoming connections.1
All 9 software entries for this technique · 6 newest in this preview
Offense vs defense T1686.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 0
first rule: 2019 Q1 · 2 of 2 campaigns plottedWindows Host Firewall detection strategy DET0901
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Windows Firewall
1 platform
AN2043 · Windows
Detects processes or users modifying Windows Defender Firewall profiles, policies, or rules followed by measurable network exposure changes. Correlates firewall management execution, registry/policy mutation, service state changes, and subsequent inbound or outbound connectivity inconsistent with baseline administration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Windows Registry Key CreationDC0056 | WinEventLog:Sysmon | EventCode=12 |
| Service CreationDC0060 | WinEventLog:System | EventCode=7036 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Network Connection CreationDC0082 | WinEventLog:Security | EventCode=5156, 5157 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedAdminAccounts | Known administrators allowed to manage host firewall settings |
| MaintenanceWindow | Approved change windows where firewall modifications are expected |
| ExposureCorrelationWindow | Time window to correlate firewall change with new connections/listeners |
| SensitivePorts | Ports of concern such as RDP, SMB, WinRM, SSH, custom admin ports |
| AllowedManagementParents | Expected parent processes such as SCCM, Intune agent, GPO client |
| RuleScopeThreshold | Detect widening from subnet/local scope to Any/0.0.0.0/0 |
AuditM1047
Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls.
Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.
Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.
Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.