Disable or Modify System Firewall: Network Device Firewall T1686.002

Tactic: Defense Impairment

Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (2 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
action2eq 2add
cfgpath2eq 2firewall.address, firewall.policy

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
actioneq
add
28
cfgpatheq
firewall.address
1
cfgpatheq
firewall.policy
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Network

Domain: Network

Sigma 2 rules