T1562.004 Disable or Modify System Firewall Mappings

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-2 Account Management Protects T1562.004 Disable or Modify System Firewall
AC-3 Access Enforcement Protects T1562.004 Disable or Modify System Firewall
AC-5 Separation of Duties Protects T1562.004 Disable or Modify System Firewall
AC-6 Least Privilege Protects T1562.004 Disable or Modify System Firewall
CA-7 Continuous Monitoring Protects T1562.004 Disable or Modify System Firewall
CM-2 Baseline Configuration Protects T1562.004 Disable or Modify System Firewall
CM-5 Access Restrictions for Change Protects T1562.004 Disable or Modify System Firewall
CM-6 Configuration Settings Protects T1562.004 Disable or Modify System Firewall
CM-7 Least Functionality Protects T1562.004 Disable or Modify System Firewall
IA-2 Identification and Authentication (organizational Users) Protects T1562.004 Disable or Modify System Firewall
SI-3 Malicious Code Protection Protects T1562.004 Disable or Modify System Firewall
SI-4 System Monitoring Protects T1562.004 Disable or Modify System Firewall
SI-7 Software, Firmware, and Information Integrity Protects T1562.004 Disable or Modify System Firewall
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1562.004 Impair Defenses: Disable or Modify System Firewall
amazon_inspector Amazon Inspector technique_scores T1562.004 Disable or Modify System Firewall