T1686.002Defense Impairment
Network Device Firewall
Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
2 Sigma rules tagged T1686.002Network Device FirewallT1686.0022 general rules
- FortiGate - Firewall Address Object Addedmediumexperimental
- FortiGate - New Firewall Policy Addedmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Network Device Firewall
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.