Disable or Modify System Firewall T1686

Tactic: Defense Impairment

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.

Events covered

27 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 13RegistryEvent (Value Set)
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4946A change has been made to Windows Firewall exception list. A rule was added.
Security-AuditingEvent ID 4947A change has been made to Windows Firewall exception list. A rule was modified.
Security-AuditingEvent ID 4948A change has been made to Windows Firewall exception list. A rule was deleted.
Linux-AuditdEvent ID 1131SERVICE_STOP
Linux-AuditdEvent ID 1309EXECVE
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
Windows-Firewall-With-Advanced-SecurityEvent ID 2002A Windows Defender Firewall setting has changed.
Windows-Firewall-With-Advanced-SecurityEvent ID 2003A Windows Defender Firewall setting in the Profiles profile has changed.
Windows-Firewall-With-Advanced-SecurityEvent ID 2004A rule has been added to the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-SecurityEvent ID 2005A rule has been modified in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-SecurityEvent ID 2006A rule has been deleted in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-SecurityEvent ID 2008Windows Defender Firewall Group Policy settings have changed.
Windows-Firewall-With-Advanced-SecurityEvent ID 2009The Windows Defender Firewall service failed to load Group Policy.
Windows-Firewall-With-Advanced-SecurityEvent ID 2032Windows Defender Firewall has been reset to its default configuration.
Windows-Firewall-With-Advanced-SecurityEvent ID 2033All rules have been deleted from the Windows Defender Firewall configuration on this computer.
Windows-Firewall-With-Advanced-SecurityEvent ID 2052A rule has been deleted in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-SecurityEvent ID 2059All rules have been deleted from the Windows Defender Firewall configuration on this computer.
Windows-Firewall-With-Advanced-SecurityEvent ID 2060Windows Defender Firewall has been reset to its default configuration.
Windows-Firewall-With-Advanced-SecurityEvent ID 2071A rule has been added to the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-SecurityEvent ID 2073A rule has been modified in the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-SecurityEvent ID 2082A Windows Defender Firewall setting in the Profiles profile has changed.
Windows-Firewall-With-Advanced-SecurityEvent ID 2083A Windows Defender Firewall setting has changed.
Windows-Firewall-With-Advanced-SecurityEvent ID 2097A rule has been added to the Windows Defender Firewall exception list.
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

Patterns shared across the 50 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (36 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine16contains 16, in 1firewall, allow, firewall , advfirewall, disable
Image10ends_with 10\netsh.exe, /chkconfig, /ip6tables, /ip6tables-legacy-multi, /iptables
OriginalFileName10eq 10netsh.exe, powershell.exe, pwsh.dll
sourcetype8eq 7, in 1aws:asl, aws:cloudtrail, auditd, azure:monitor:activity, o365:management:activity
aws::eventName6eq 6CreateNetworkAclEntry, DeleteNetworkAclEntry, ReplaceNetworkAclEntry, CreateRoute
ModifyingApplication4ends_with 4, eq 2, starts_with 2, contains 1, is_null 1C:\ProgramData\Microsoft\Windows Defender\Platform\, :\Windows\System32\svchost.exe, :\Windows\System32\wbem\WmiPrvSE.exe, :\programdata\microsoft\windows defender\platform\, C:\Program Files (x86)\
operationName4eq 3, contains 1 devicemanagementconfigurationpolicy, MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIO..., MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE, MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE, MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE
type4eq 4EXECVE, SERVICE_STOP
Action3eq 32, 3
ApplicationPath3contains 3, ends_with 2, eq 1, is_null 1, starts_with 1:\perflogs\, :\temp\, :\tmp\, :\users\, C:\Program Files (x86)\
Channel3eq 3, in 3
EventID3eq 34946, 4947, 4948
eventtype3eq 3
process_name3eq 3netsh.exe
Details2eq 2DWORD (0x00000000)

Top indicator values (231 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
OriginalFileNameeq
netsh.exe
923
CommandLinecontains
firewall
813
CommandLinecontains
allow
46
CommandLinecontains
add
334
CommandLinecontains
advfirewall
37
CommandLinecontains
disable
313
CommandLinecontains
enable
33
CommandLinecontains
firewall
23
CommandLinecontains
enable=yes
22
CommandLinecontains
off
24
CommandLinecontains
rule
22
CommandLinecontains
set
211
Imageends_with
\netsh.exe
628
aws::eventNameeq
CreateNetworkAclEntry
33
aws::eventNameeq
DeleteNetworkAclEntry
22
aws::eventNameeq
ReplaceNetworkAclEntry
22
process_nameeq
netsh.exe
318
Actioneq
2
2
ApplicationPathcontains
\appdata\local\temp\
2
Detailseq
DWORD (0x00000000)
238
ModifyingApplicationends_with
\MsMpEng.exe
2
ModifyingApplicationeq
C:\Windows\System32\svchost.exe
2
ModifyingApplicationstarts_with
C:\ProgramData\Microsoft\Windows Defender\Platform\
2
ModifyingApplicationstarts_with
C:\Windows\WinSxS\
2
aws::eventSourceeq
ec2.amazonaws.com
219
egresseq
false
23
requestParameters.egresseq
false
22
sourcetypeeq
aws:asl
227
sourcetypeeq
aws:cloudtrail
259
statuseq
Success
23

Exclusions (46 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Actioneq
2
2
ModifyingApplicationends_with
\MsMpEng.exe
2
ModifyingApplicationeq
C:\Windows\System32\svchost.exe
2
ModifyingApplicationstarts_with
C:\ProgramData\Microsoft\Windows Defender\Platform\
2
ModifyingApplicationstarts_with
C:\Windows\WinSxS\
2
"Processes.parent_process_path"in
/bin/*
1
"Processes.parent_process_path"in
/lib/*
1
"Processes.parent_process_path"in
/sbin/*
1
"Processes.parent_process_path"in
/usr/bin/*
1
ApplicationPathcontains
:\users\
1
ApplicationPathcontains
\appdata\local\bravesoftware\brave-browser\application\brave.exe
1
ApplicationPathcontains
\appdata\local\programs\opera\
1
ApplicationPathcontains
\appdata\local\temp\
1
ApplicationPathcontains
\opera.exe
1
ApplicationPathcontains
c:\perflogs\
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 32 rules

Splunk 18 rules