Impair Defenses: Disable or Modify System Firewall T1562.004

Tactic: Stealth

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Events covered

12 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 25 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (35 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
process_name9eq 6, match 3, in 1(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe, netsh.exe, almon.exe, alsvc.exe, alupdate.exe
event.type5eq 5start
process.args5eq 4, contains 1, in 1advfirewall, firewall, --delete-chain, --flush, -F
CommandLine4contains 4, starts_with 2advfirewall, firewall, a, d, f
EventID4eq 44104, 4688, 4103
Image3ends_with 3\netsh.exe
EventData2contains 222, action, allow, enabled, false
EventType2eq 1, in 1exec, exec_event, start, windows-firewall-packet-block, windows-firewall-packet-drop
LocalPorts2eq 1, wildcard 1*, 22
OriginalFileName2eq 1, in 1netsh.exe, powershell.exe, powershell_ise.exe, pwsh.dll
Payload2contains 222, action, allow, enabled, false
ScriptBlockText2contains 222, action, allow, enabled, false
Action1eq 13
ApplicationPath1ends_with 1\sshd.exe
LocalAddresses1wildcard 1*

Top indicator values (366 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
5606
CommandLinecontains
netsh
49
CommandLinecontains
firewall
313
CommandLinecontains
advfirewall
27
CommandLinecontains
set
211
CommandLinecontains
22
1
CommandLinecontains
add
134
CommandLinecontains
disable
113
CommandLinecontains
localport=
1
CommandLinecontains
off
14
CommandLinecontains
opmode
12
CommandLinecontains
portopening
12
CommandLinecontains
state
12
Imageends_with
\netsh.exe
328
process_nameeq
netsh.exe
318
process_namematch
(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe
33
CommandLinestarts_with
s
22
CommandLinestarts_with
a
12
CommandLinestarts_with
d
1
CommandLinestarts_with
f
1
CommandLinestarts_with
o
1
EventIDeq
4104
2268
EventIDeq
4688
2313
process.argseq
advfirewall
22
process.argseq
disable
23
process.argseq
enable=Yes
22
process.argseq
firewall
22
process.argseq
off
26
Actioneq
3
12
ApplicationPathends_with
\sshd.exe
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 11 rules

Elastic 6 rules

Splunk 5 rules

Kusto 1 rule

Panther 2 rules