T1686.001sub-technique of T1686 Disable or Modify System Firewall

Cloud Firewall

IaaSnothing on this site yetT1686.001 on attack.mitre.org

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Ransomware, suspected or confirmed

Files renamed or unreadable, a ransom note, or backup deletion commands seen.

how MITRE says to see it

Detection Strategy for Disable or Modify Cloud Firewall

Creation, deletion, or modification of security groups and firewall rules in cloud control plane logs that expand access to cloud resources beyond expected baselines. Defender view: unexpected ingress/egress rules permitting 0.0.0.0/0 or opening atypical ports, often correlated with privileged role or API key activity.

what reduces it

M1018 User Account Management. Ensure least privilege principles are applied to Identity and Access Management (IAM) security policies.
M1047 Audit. Routinely check account role permissions to ensure only expected users and roles have permission to modify cloud firewalls.

the rest of T1686

T1686.002 Network Device Firewall · not covered yet
T1686.003 Windows Host Firewall · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.