T1686
Disable or Modify System Firewall
ESXi · Linux · macOS · Network Devices · Windows1 piece on this siteT1686 on attack.mitre.org
Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Artifact reference
Windows Firewall log
T1686
how MITRE says to see it
Detection of Disabled or Modified System Firewalls across OS Platforms.
- Detection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy also indicate adversarial actions.
- Detection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.
- Detection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.
- Detection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.
what reduces it
- M1018 User Account Management. Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.
- M1022 Restrict File and Directory Permissions. Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.
- M1024 Restrict Registry Permissions. Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.
- M1047 Audit. Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls.