Disable or Modify System Firewall `T1686`

Tactic: Defense Impairment

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.

Events covered

33 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 13	RegistryEvent (Value Set)
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4946	A change has been made to Windows Firewall exception list. A rule was added.
Security-Auditing	Event ID 4947	A change has been made to Windows Firewall exception list. A rule was modified.
Security-Auditing	Event ID 4948	A change has been made to Windows Firewall exception list. A rule was deleted.
Security-Auditing	Event ID 4950	A Windows Firewall setting has changed.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Linux-Auditd	Event ID 1131	SERVICE_STOP
Linux-Auditd	Event ID 1309	EXECVE
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Windows-Firewall-With-Advanced-Security	Event ID 2002	A Windows Defender Firewall setting has changed.
Windows-Firewall-With-Advanced-Security	Event ID 2003	A Windows Defender Firewall setting in the Profiles profile has changed.
Windows-Firewall-With-Advanced-Security	Event ID 2004	A rule has been added to the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2005	A rule has been modified in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2006	A rule has been deleted in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2008	Windows Defender Firewall Group Policy settings have changed.
Windows-Firewall-With-Advanced-Security	Event ID 2009	The Windows Defender Firewall service failed to load Group Policy.
Windows-Firewall-With-Advanced-Security	Event ID 2032	Windows Defender Firewall has been reset to its default configuration.
Windows-Firewall-With-Advanced-Security	Event ID 2033	All rules have been deleted from the Windows Defender Firewall configuration on this computer.
Windows-Firewall-With-Advanced-Security	Event ID 2052	A rule has been deleted in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2059	All rules have been deleted from the Windows Defender Firewall configuration on this computer.
Windows-Firewall-With-Advanced-Security	Event ID 2060	Windows Defender Firewall has been reset to its default configuration.
Windows-Firewall-With-Advanced-Security	Event ID 2071	A rule has been added to the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2073	A rule has been modified in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2082	A Windows Defender Firewall setting in the Profiles profile has changed.
Windows-Firewall-With-Advanced-Security	Event ID 2083	A Windows Defender Firewall setting has changed.
Windows-Firewall-With-Advanced-Security	Event ID 2097	A rule has been added to the Windows Defender Firewall exception list.
PowerShell	Event ID 800	Event ID 800
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 133 rules share fields, values, and exclusions.

Fields filtered most (88 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	26	`eq` 15, `in` 7, `wildcard` 6, `ends_with` 3	`AuthorizeSecurityGroupIngress`, `CreateNetworkAclEntry`, `start`, `.compute.firewalls.delete`, `.compute.firewalls.insert`
`data_stream.dataset`	25	`eq` 25	`okta.system`, `aws.cloudtrail`, `gcp.audit`, `azure.activitylogs`, `google_workspace.admin`
`CommandLine`	22	`contains` 21, `in` 1, `match` 1, `wildcard` 1	`firewall`, `advfirewall`, `ENABLE`, `firewall`, `allow`
`Image`	14	`ends_with` 13, `starts_with` 1	`\netsh.exe`, `/chkconfig`, `/ip6tables`, `/ip6tables-legacy-multi`, `/iptables`
`aws::eventName`	14	`eq` 8, `in` 6	`CreateNetworkAclEntry`, `ReplaceNetworkAclEntry`, `AuthorizeDBSecurityGroupIngress`, `DeleteNetworkAclEntry`, `ApplySecurityGroupsToLoadBalancer`
`data.type`	13	`eq` 13	`sapi`, `f`, `fcoa`, `fepft`
`OriginalFileName`	12	`eq` 11, `in` 1	`netsh.exe`, `PowerShell.EXE`, `pwsh.dll`, `powershell_ise.EXE`
`data.description`	11	`eq` 11	`Create or update the anomaly detection captcha`, `Update Brute-force settings`, `Update Suspicious IP Throttling settings`, `Update Breached Password Detection settings`, `Update a client`
`event.outcome`	11	`eq` 10, `in` 1	`success`, `Success`, `failure`
`process_basename`	10	`eq` 10, `in` 1	`netsh.exe`, `ALMon.exe`, `ALUpdate.exe`, `ALsvc.exe`, `chkconfig`
`EventID`	8	`eq` 8	`4104`, `4688`, `4103`, `4946`, `4947`
`sourcetype`	8	`eq` 7, `in` 1	`aws:asl`, `aws:cloudtrail`, `auditd`, `azure:monitor:activity`, `o365:management:activity`
`Provider_Name`	7	`eq` 5, `in` 2	`ec2.amazonaws.com`, `waf-regional.amazonaws.com`, `waf.amazonaws.com`, `wafv2.amazonaws.com`
`operationName`	6	`eq` 4, `contains` 1, `in` 1	`MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE`, `* DeviceManagementConfigurationPolicy*`, `MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIO...`, `MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE`, `MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE`
`ModifyingApplication`	5	`ends_with` 5, `eq` 2, `starts_with` 2, `contains` 1, `is_null` 1	, `:\ProgramData\Microsoft\Windows Defender\Platform\`, `:\Windows\System32\svchost.exe`, `:\Windows\System32\wbem\WmiPrvSE.exe`, `C:\Program Files (x86)\`

Top indicator values (739 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`data.type`	`eq`	`sapi` sigmaAttack protection features manipulation - some attack protection features have been disabled. sigmaBot detection - the feature is turned off completely or some policies. sigmaBreached Password Detection - critical settings manipulated sigmaBrute Force Protection - critical settings manipulated sigmaInsecure OAuth2.x flows have been enabled for some applications sigmaLoaded LiquidJS error page template contains XSS vulnerabilities sigmaMFA downgrade - adaptive MFA risk assessment disabled sigmaMFA downgrade - disable MFA policies by modifying the policies sigmaMFA downgrade - disable strong factors sigmaSuspicious IP Throttling - critical settings manipulated sigmaUnauthorized or Unexpected Enabling of Cross-Origin Authentication (CORS) sigmaUnrecognized IP in attack protection allowlists	12	16
`CommandLine`	`contains`	`firewall` sigmaFirewall deactivation (deprecated command) sigmaFirewall Disabled via Netsh.EXE sigmaFirewall rule creation (command) sigmaFirewall Rule Deleted Via Netsh.EXE sigmaNetsh Allow Group Policy on Microsoft Defender Firewall sigmaOpenSSH server firewall configuration on Windows (command) sigmaSuspicious Program Location Whitelisted In Firewall Via Netsh.EXE splunkAllow File And Printing Sharing In Firewall splunkAllow Network Discovery In Firewall splunkFirewall Allowed Program Enable splunkWindows Modify System Firewall with Notable Process Path	11	13
`CommandLine`	`contains`	`advfirewall` sigmaFirewall deactivation (modern command) sigmaFirewall Disabled via Netsh.EXE sigmaNetsh Allow Group Policy on Microsoft Defender Firewall sigmaOpenSSH server firewall configuration on Windows (command) sigmaSuspicious Program Location Whitelisted In Firewall Via Netsh.EXE	5	6
`CommandLine`	`contains`	`add` sigmaFirewall rule creation (command) sigmaSuspicious Program Location Whitelisted In Firewall Via Netsh.EXE splunkFirewall Allowed Program Enable splunkWindows Modify System Firewall with Notable Process Path	4	30
`CommandLine`	`contains`	`allow` sigmaNew Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet sigmaRDP Connection Allowed Via Netsh.EXE splunkFirewall Allowed Program Enable splunkWindows Modify System Firewall with Notable Process Path	4	6
`CommandLine`	`contains`	`disable` sigmaDisabling Security Tools sigmaFirewall deactivation (deprecated command) sigmaFirewall Disabled via Netsh.EXE sigmaUFW Disable Attempt	4	13
`CommandLine`	`contains`	`netsh` sigmaFirewall deactivation (deprecated command) sigmaFirewall deactivation (modern command) sigmaFirewall rule creation (command) sigmaOpenSSH server firewall configuration on Windows (command)	4	9
`CommandLine`	`contains`	`set` sigmaFirewall deactivation (deprecated command) sigmaFirewall deactivation (modern command) sigmaFirewall Disabled via Netsh.EXE sigmaNetsh Allow Group Policy on Microsoft Defender Firewall	4	11
`CommandLine`	`contains`	`ENABLE` splunkAllow Network Discovery In Firewall splunkFirewall Allowed Program Enable splunkWindows Modify System Firewall with Notable Process Path	3	3
`CommandLine`	`contains`	`off` sigmaDisabling Security Tools sigmaFirewall deactivation (modern command) sigmaFirewall Disabled via Netsh.EXE	3	4
`event.outcome`	`eq`	`Success` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Network Access Control List Deletion elasticAWS EC2 Security Group Configuration Change elasticAWS WAF Access Control List Deletion elasticAWS WAF Rule or Rule Group Deletion elasticAzure VNet Firewall Front Door WAF Policy Deleted elasticAzure VNet Firewall Policy Deleted elasticGCP Virtual Private Cloud Network Deletion elasticGCP Virtual Private Cloud Route Deletion elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	10	306
`Image`	`ends_with`	`\netsh.exe` sigmaFirewall deactivation (deprecated command) sigmaFirewall deactivation (modern command) sigmaFirewall Disabled via Netsh.EXE sigmaFirewall rule creation (command) sigmaFirewall Rule Deleted Via Netsh.EXE sigmaNetsh Allow Group Policy on Microsoft Defender Firewall sigmaNew Firewall Rule Added Via Netsh.EXE sigmaRDP Connection Allowed Via Netsh.EXE sigmaSuspicious Program Location Whitelisted In Firewall Via Netsh.EXE	9	28
`OriginalFileName`	`eq`	`netsh.exe` sigmaFirewall Disabled via Netsh.EXE sigmaFirewall Rule Deleted Via Netsh.EXE sigmaNetsh Allow Group Policy on Microsoft Defender Firewall sigmaNew Firewall Rule Added Via Netsh.EXE sigmaRDP Connection Allowed Via Netsh.EXE sigmaSuspicious Program Location Whitelisted In Firewall Via Netsh.EXE splunkAllow File And Printing Sharing In Firewall splunkAllow Network Discovery In Firewall splunkWindows Delete or Modify System Firewall	9	21
`data_stream.dataset`	`eq`	`okta.system` elasticAttempt to Deactivate an Okta Network Zone elasticAttempt to Deactivate an Okta Policy elasticAttempt to Deactivate an Okta Policy Rule elasticAttempt to Delete an Okta Network Zone elasticAttempt to Delete an Okta Policy elasticAttempt to Delete an Okta Policy Rule elasticAttempt to Modify an Okta Network Zone elasticAttempt to Modify an Okta Policy elasticAttempt to Modify an Okta Policy Rule	9	35
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Network Access Control List Deletion elasticAWS EC2 Security Group Configuration Change elasticAWS WAF Access Control List Deletion elasticAWS WAF Rule or Rule Group Deletion elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	7	143
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP Firewall Rule Creation elasticGCP Firewall Rule Deletion elasticGCP Firewall Rule Modification elasticGCP Virtual Private Cloud Network Deletion elasticGCP Virtual Private Cloud Route Creation elasticGCP Virtual Private Cloud Route Deletion	6	60
`process_basename`	`eq`	`netsh.exe` elasticDisable Windows Firewall Rules via Netsh elasticEnable Host Network Discovery via Netsh elasticRemote Desktop Enabled in Windows Firewall by Netsh elasticWindows Firewall Exception List Modified via Untrusted Process splunkAllow File And Printing Sharing In Firewall splunkAllow Network Discovery In Firewall splunkWindows Delete or Modify System Firewall	7	21
`Provider_Name`	`eq`	`ec2.amazonaws.com` elasticAWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Network Access Control List Deletion elasticAWS EC2 Security Group Configuration Change elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	5	18
`event.type`	`eq`	`start` elasticAttempt to Disable IPTables or Firewall elasticDisable Windows Firewall Rules via Netsh elasticEnable Host Network Discovery via Netsh elasticRemote Desktop Enabled in Windows Firewall by Netsh elasticWindows Firewall Disabled via PowerShell	5	1036
`data.details.response.body.enabled`	`eq`	`false` sigmaAttack protection features manipulation - some attack protection features have been disabled. sigmaBreached Password Detection - critical settings manipulated sigmaBrute Force Protection - critical settings manipulated sigmaSuspicious IP Throttling - critical settings manipulated	4	4
`OperationName`	`eq`	`Update conditional access policy` kustoConditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) kustoConditional Access - A Conditional Access policy was disabled kustoConditional Access - A Conditional Access policy was put into report-only mode	3	6
`aws::errorCode`	`is_null`	kustoAWSCloudTrail - Network ACL with all the open ports to a specified CIDR pantherAWS RDS Instance Modified to be Publicly Accessible pantherAWS RDS Security Group Ingress Authorized	3	50
`aws::eventName`	`eq`	`CreateNetworkAclEntry` sigmaNew Network ACL Entry Added splunkASL AWS Network Access Control List Created with All Open Ports splunkAWS Network Access Control List Created with All Open Ports	3	3
`data.description`	`eq`	`Create or update the anomaly detection captcha` sigmaAttack protection features manipulation - some attack protection features have been disabled. sigmaBot detection - the feature is turned off completely or some policies. sigmaUnrecognized IP in attack protection allowlists	3	3
`data.description`	`eq`	`Update Brute-force settings` sigmaAttack protection features manipulation - some attack protection features have been disabled. sigmaBrute Force Protection - critical settings manipulated sigmaUnrecognized IP in attack protection allowlists	3	3
`data.description`	`eq`	`Update Suspicious IP Throttling settings` sigmaAttack protection features manipulation - some attack protection features have been disabled. sigmaSuspicious IP Throttling - critical settings manipulated sigmaUnrecognized IP in attack protection allowlists	3	3
`data.details.response.statusCode`	`eq`	`200` sigmaBot detection - the feature is turned off completely or some policies. sigmaInsecure OAuth2.x flows have been enabled for some applications sigmaMFA downgrade - adaptive MFA risk assessment disabled	3	3
`process_name`	`regex_match`	`(?i)cmd\|powershell\|netsh\|net1?\|sc.exe\|reg.exe` splunkWindows Firewall Disabled (PowerShell) splunkWindows Firewall Disabled (Sysmon) splunkWindows Firewall Disabled (Windows Event Log)	3	3
`Action`	`eq`	`2` sigmaNew Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	2
`Action`	`eq`	`3` sigmaFirewall rule any/any created sigmaNew Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE	2	2

Exclusions (65 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`Pulumi` elasticAWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Network Access Control List Deletion elasticAWS EC2 Security Group Configuration Change elasticAWS WAF Access Control List Deletion elasticAWS WAF Rule or Rule Group Deletion elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	7
`aws::userAgent`	`contains`	`Terraform` elasticAWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Network Access Control List Deletion elasticAWS EC2 Security Group Configuration Change elasticAWS WAF Access Control List Deletion elasticAWS WAF Rule or Rule Group Deletion elasticInsecure AWS EC2 VPC Security Group Ingress Rule Added	7
`aws::userAgent`	`contains`	`Ansible` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Network Access Control List Deletion elasticAWS EC2 Security Group Configuration Change	3
`Action`	`eq`	`2` sigmaNew Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	2
`ModifyingApplication`	`ends_with`	`\MsMpEng.exe` sigmaA Rule Has Been Deleted From The Windows Firewall Exception List sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	2
`ModifyingApplication`	`eq`	`C:\Windows\System32\svchost.exe` sigmaA Rule Has Been Deleted From The Windows Firewall Exception List sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	2
`ModifyingApplication`	`starts_with`	`C:\ProgramData\Microsoft\Windows Defender\Platform\` sigmaA Rule Has Been Deleted From The Windows Firewall Exception List sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	2
`ModifyingApplication`	`starts_with`	`C:\Windows\WinSxS\` sigmaA Rule Has Been Deleted From The Windows Firewall Exception List sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	2
`data.details.response.body.shields{}`	`eq`	`block` sigmaBreached Password Detection - critical settings manipulated sigmaBrute Force Protection - critical settings manipulated	2
`ApplicationPath`	`contains`	`:\Users\` sigmaFirewall Rule Modified In The Windows Firewall Exception List	1
`ApplicationPath`	`contains`	`C:\PerfLogs\` sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	1
`ApplicationPath`	`contains`	`\AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe` sigmaFirewall Rule Modified In The Windows Firewall Exception List	1
`ApplicationPath`	`contains`	`\AppData\Local\Programs\Opera\` sigmaFirewall Rule Modified In The Windows Firewall Exception List	1
`ApplicationPath`	`contains`	`\AppData\Local\Temp\` sigmaUncommon New Firewall Rule Added In Windows Firewall Exception List	1
`ApplicationPath`	`contains`	`\opera.exe` sigmaFirewall Rule Modified In The Windows Firewall Exception List	1

Disable or Modify System Firewall `T1686`

Events covered

Authoring guide

Fields filtered most (88 distinct)

Top indicator values (739 distinct)

Exclusions (65 distinct)

Rules under this technique

Sigma 59 rules

Elastic 32 rules

Splunk 24 rules

Kusto 11 rules

YARA-L 1 rule

Panther 6 rules

Disable or Modify System Firewall T1686

Events covered

Authoring guide

Fields filtered most (88 distinct)

Top indicator values (739 distinct)

Exclusions (65 distinct)

Rules under this technique

Sigma 59 rules

Elastic 32 rules

Splunk 24 rules

Kusto 11 rules

YARA-L 1 rule

Panther 6 rules

Disable or Modify System Firewall `T1686`