T1686.003sub-technique of T1686 Disable or Modify System Firewall
Windows Host Firewall
Windowsnothing on this site yetT1686.003 on attack.mitre.org
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic. Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Detect Windows Firewall
- Detects processes or users modifying Windows Defender Firewall profiles, policies, or rules followed by measurable network exposure changes. Correlates firewall management execution, registry/policy mutation, service state changes, and subsequent inbound or outbound connectivity inconsistent with baseline...
what reduces it
- M1018 User Account Management. Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.
- M1022 Restrict File and Directory Permissions. Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.
- M1024 Restrict Registry Permissions. Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.
- M1047 Audit. Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls.