Disable or Modify System Firewall detection rulesT1686

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

windows

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

linux

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

windows

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

windows · process_creation

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

windows · process_creation

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

windows

Identifies when a firewall is created, modified, or deleted.

azure

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

azure

Identifies when a Firewall Policy is Modified or Deleted.

azure

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

linux

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

windows · registry_set

Detect set EnableFirewall to 0 to disable the Windows firewall

windows · registry_set

Detects disabling security tools

linux · process_creation

Detects disabling security tools

linux

Detects netsh commands that turns off the Windows firewall

windows · process_creation

Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

windows · process_creation

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

linux · process_creation

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

fortigate

Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

fortigate

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

linux

Adversaries may modify system firewalls in order to bypass controls limiting network usage

windows · process_creation

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

windows

Detects the addition of a new rule to the Windows firewall via netsh

windows · process_creation

Detects the addition of a new network route to a route table in AWS.

aws

Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.

linux · process_creation

Detects when a rule has been added to the Windows Firewall exception list

windows

Detects when a user disables the Windows Firewall via a Profile to help evade defense.

windows · ps_script

Detects when a rule has been modified in the Windows firewall exception list

windows

Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

aws

Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action.

windows · process_creation

Detects when a powershell script contains calls to the "New-NetFirewallRule" cmdlet in order to add a new firewall rule with an "Allow" action.

windows · ps_script

Detects activity when The Windows Defender Firewall service failed to load Group Policy

windows

Detects activity when Windows Defender Firewall has been reset to its default configuration

windows

Detects activity when the settings of the Windows firewall have been changed

windows