Techniques › T1686 › T1686.001
T1686.001 Cloud Firewall
defense impairment — IaaS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
5
Sigma rules tagged attack.t1686.001
0
KEV CVEs mapped here
<p>Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.</p><p>Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane.</p><p>For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0424 Detection Strategy for Disable or Modify Cloud Firewall v1.0
AN1188 IaaSCreation, deletion, or modification of security groups and firewall rules in cloud control plane logs that expand access to cloud resources beyond expected baselines. Defender view: unexpected ingress/egress rules permitting 0.0.0.0/0 or opening atypical ports, often correlated with privileged role or API key activity.AWS:CloudTrail
Ingress rule creation or modification for security group→ DC0051 Firewall Rule ModificationTunable:AllowedIPRangesPortScopeRoleContextTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1686.001
Author: Austin Songer @austinsonger
· 2021-08-08 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 025c9fe7-db72-49f9-af0d-31341dd7dd57
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-08 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 512cf937-ea9b-4332-939c-4c2c94baadcd
Identifies when a firewall is created, modified, or deleted.
Author: Austin Songer @austinsonger
· 2021-09-02 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 83c17918-746e-4bd9-920b-8e098bf88c23
Identifies when a Firewall Policy is Modified or Deleted.
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · c803b2ce-c4a2-4836-beae-b112010390b1
Detects the addition of a new network route to a route table in AWS.
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · e1f7febb-7b94-4234-b5c6-00fb8500f5dd
Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.
Rules tagged at the parent level (attack.t1686) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: IAI
· 2023-03-06 (modified 2025-10-12) · logsource: product=linux service=auditd · 323ff3f5-0013-4847-bbd4-250b5edb62cc
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-18 · logsource: product=linux category=process_creation · 3be619f4-d9ec-4ea8-a173-18fdd01996ab
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Author: Ömer Günal, Alejandro Ortuno, oscd.community
· 2020-06-17 (modified 2022-11-26) · logsource: product=linux service=syslog · 49f5dfc1-f92e-4d34-96fa-feba3f6acf36
Detects disabling security tools
Author: Pawel Mazur
· 2022-01-22 · logsource: product=linux service=auditd · 53059bc0-1472-438b-956a-7508a94a91f0
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
Author: Rafal Piasecki
· 2022-08-10 · logsource: product=linux service=auditd · 70b4156e-50fc-4523-aa50-c9dddf1993fc
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-18 (modified 2026-05-04) · logsource: product=linux category=process_creation · 84c9e83c-599a-458a-a0cb-0ecce44e807a
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Author: Ömer Günal, Alejandro Ortuno, oscd.community
· 2020-06-17 (modified 2022-10-09) · logsource: product=linux category=process_creation · e3a8a052-111f-4606-9aee-f28ebeb76776
Detects disabling security tools