| ID | Name |
|---|---|
| T1686.001 | Cloud Firewall |
| T1686.002 | Network Device Firewall |
| T1686.003 | Windows Host Firewall |
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.[1]
Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., netsh advfirewall or PowerShell cmdlets like Set-NetFirewallProfile, New-NetFirewallRule), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.
By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
| ID | Name | Description |
|---|---|---|
| C0051 | APT28 Nearest Neighbor Campaign |
During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim's Windows firewall to set up a series of port-forwards allowing traffic to target systems.[1] |
| S0245 | BADCALL |
BADCALL disables the Windows firewall before binding to a port.[2] |
| S1181 | BlackByte 2.0 Ransomware |
BlackByte 2.0 Ransomware modifies the Windows firewall during execution.[3] |
| S0334 | DarkComet |
DarkComet can disable Security Center functions like the Windows Firewall.[4][5] |
| S0132 | H1N1 | |
| S0246 | HARDRAIN |
HARDRAIN opens the Windows Firewall to modify incoming connections.[7] |
| S9023 | HiddenFace |
HiddenFace can reconfigure Windows firewalls to enable communication by adding a rule named "Cortana" to allow inbound connection to TCP/47000.[8][9] |
| G0032 | Lazarus Group |
Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. [10][11][12] |
| G0059 | Magic Hound |
Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - |
| G1054 | MirrorFace |
MirrorFace can modify the system firewall to allow communication to certain ports.[15] |
| G1009 | Moses Staff |
Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.[16] |
| S0385 | njRAT |
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.[17][18] |
| G0049 | OilRig |
OilRig has modified Windows firewall rules to enable remote access.[19] |
| C0014 | Operation Wocao |
During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.[20] |
| S0125 | Remsec |
Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.[21] |
| S0263 | TYPEFRAME |
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.[22] |
| G1055 | VOID MANTICORE |
VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.[23] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls. |
| M1022 | Restrict File and Directory Permissions |
Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings. |
| M1024 | Restrict Registry Permissions |
Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings. |
| M1018 | User Account Management |
Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0901 | Detect Windows Firewall | AN2043 |
Detects processes or users modifying Windows Defender Firewall profiles, policies, or rules followed by measurable network exposure changes. Correlates firewall management execution, registry/policy mutation, service state changes, and subsequent inbound or outbound connectivity inconsistent with baseline administration. |