Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity)
Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., netsh advfirewall or PowerShell cmdlets like Set-NetFirewallProfile, New-NetFirewallRule), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.
By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Disable controls | Disable or interfere with security controls | related-to | T1686.003 | Windows Host Firewall |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| vm_manager | VM Manager | technique_scores | T1686.003 | Windows Host Firewall |
Comments
VM Manager OS policies can enforce Windows configuration state through managed files, scripts, packages, and policy assignments. If an organization explicitly uses OS policies to maintain Windows Firewall configuration or associated permissions, VM Manager can help restore or enforce the intended firewall state after unauthorized modification. This mapping is Minimal because the protection depends on specific policy configuration and VM Manager does not inherently prevent all firewall changes.
References
|