Techniques › T1686 › T1686.002
T1686.002 Network Device Firewall
defense impairment — Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
2
Sigma rules tagged attack.t1686.002
0
KEV CVEs mapped here
<p>Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.</p><p>Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement.</p><p>Adversaries may obtain access to network device management interfaces via Valid Accounts or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications (Exploit Public-Facing Application).</p><p>Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0306 Detection of Unauthorized Network Firewall Rule Modification v1.0
AN0855 Network DevicesDefender observes configuration changes on firewall/network appliance involving rule creation, modification, or deletion from abnormal management IPs or non-console channels (e.g., remote CLI, API). These are often correlated with a spike in previously blocked outbound traffic, unexpected allow-all rules, or bulk rule deletions. Behavior often follows unauthorized login, privilege escalation, or API abuse.networkdevice:Firewall
update_rule: Access control or NAT rule modified or disabled outside maintenance window→ DC0051 Firewall Rule Modificationnetworkdevice:FirewallLogin from untrusted IP, or new admin account accessing firewall console/API→ DC0067 Logon Session Creationnetworkdevice:FirewallAudit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config→ DC0064 Command ExecutionNSM:FlowOutbound traffic spike through formerly blocked ports/subnets following config change→ DC0082 Network Connection CreationTunable:TrustedAdminIPsConfigChangeWindowRuleScopeThresholdNewUserPrivilegeThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1686.002
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 (modified 2026-05-04) · logsource: product=fortigate service=event · 5c8d7b41-3812-432f-a0bb-4cfb7c31827e
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 (modified 2026-05-04) · logsource: product=fortigate service=event · f24ab7a8-f09a-4319-82c1-915586aa642b
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
Rules tagged at the parent level (attack.t1686) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: IAI
· 2023-03-06 (modified 2025-10-12) · logsource: product=linux service=auditd · 323ff3f5-0013-4847-bbd4-250b5edb62cc
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-18 · logsource: product=linux category=process_creation · 3be619f4-d9ec-4ea8-a173-18fdd01996ab
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Author: Ömer Günal, Alejandro Ortuno, oscd.community
· 2020-06-17 (modified 2022-11-26) · logsource: product=linux service=syslog · 49f5dfc1-f92e-4d34-96fa-feba3f6acf36
Detects disabling security tools
Author: Pawel Mazur
· 2022-01-22 · logsource: product=linux service=auditd · 53059bc0-1472-438b-956a-7508a94a91f0
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
Author: Rafal Piasecki
· 2022-08-10 · logsource: product=linux service=auditd · 70b4156e-50fc-4523-aa50-c9dddf1993fc
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-18 (modified 2026-05-04) · logsource: product=linux category=process_creation · 84c9e83c-599a-458a-a0cb-0ecce44e807a
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Author: Ömer Günal, Alejandro Ortuno, oscd.community
· 2020-06-17 (modified 2022-10-09) · logsource: product=linux category=process_creation · e3a8a052-111f-4606-9aee-f28ebeb76776
Detects disabling security tools