T1686.003Defense Impairment
Windows Host Firewall
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic. Adversaries may perform these modifications through multiple mechanisms depending on the…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
22 Sigma rules tagged T1686.003Windows Host FirewallT1686.00322 general rules
- All Rules Have Been Deleted From The Windows Firewall Configurationhightest
- New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Applicationhightest
- RDP Connection Allowed Via Netsh.EXEhightest
- Suspicious Program Location Whitelisted In Firewall Via Netsh.EXEhightest
- A Rule Has Been Deleted From The Windows Firewall Exception Listmediumtest
- Disable Microsoft Defender Firewall via Registrymediumtest
- Disable Windows Firewall by Registrymediumtest
- Firewall Disabled via Netsh.EXEmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Windows Host Firewall
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.