Techniques › T1686
T1686 Disable or Modify System Firewall
defense impairment — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
7
Sigma rules tagged attack.t1686
0
KEV CVEs mapped here
<p>Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.</p><p>Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0145 Detection of Disabled or Modified System Firewalls across OS Platforms. v1.0
AN0406 WindowsDetection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy also indicate adversarial actions.Tunable:
MonitoredCommandsAlertThresholdAN0407 LinuxDetection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.Tunable:AllowedScriptsAN0408 macOSDetection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.macos:unifiedlogpfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf→ DC0064 Command ExecutionTunable:PFConfigFilesAN0409 ESXiDetection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.Tunable:APIMethodsAN0410 Network DevicesDetection of firewall ACL or rule base changes through CLI (e.g., no access-list, permit any any). Monitor configuration commits from unusual users or sessions.networkdevice:clifirewall disable commands or suspicious ACL modifications→ DC0051 Firewall Rule ModificationTunable:AuthorizedAdmins
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1686
Author: IAI
· 2023-03-06 (modified 2025-10-12) · logsource: product=linux service=auditd · 323ff3f5-0013-4847-bbd4-250b5edb62cc
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-18 · logsource: product=linux category=process_creation · 3be619f4-d9ec-4ea8-a173-18fdd01996ab
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Author: Ömer Günal, Alejandro Ortuno, oscd.community
· 2020-06-17 (modified 2022-11-26) · logsource: product=linux service=syslog · 49f5dfc1-f92e-4d34-96fa-feba3f6acf36
Detects disabling security tools
Author: Pawel Mazur
· 2022-01-22 · logsource: product=linux service=auditd · 53059bc0-1472-438b-956a-7508a94a91f0
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
Author: Rafal Piasecki
· 2022-08-10 · logsource: product=linux service=auditd · 70b4156e-50fc-4523-aa50-c9dddf1993fc
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-18 (modified 2026-05-04) · logsource: product=linux category=process_creation · 84c9e83c-599a-458a-a0cb-0ecce44e807a
Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.
UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.
Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.
Author: Ömer Günal, Alejandro Ortuno, oscd.community
· 2020-06-17 (modified 2022-10-09) · logsource: product=linux category=process_creation · e3a8a052-111f-4606-9aee-f28ebeb76776
Detects disabling security tools