T1686.003 Disable or Modify System Firewall: Windows Host Firewall

Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1686.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1686Disable or Modify System Firewall

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highSuspicious Program Location Whitelisted In Firewall Via Netsh.EXESander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community · Windows

mediumNew Firewall Rule Added Via Netsh.EXEMarkus Neis, Sander Wiebing · Windows

everyday examples from tldr-pages, CC BY 4.0

To delete a connection security rule by its name, run the following command on the page for netsh advfirewall

netsh advfirewall consec delete rule name="RuleName"Identify

To add a rule allowing inbound traffic on port 8080, run the following command on the page for netsh advfirewall

netsh advfirewall firewall add rule name="Allow8080" protocol=TCP dir=in localport=8080 action=allowIdentify

To block outgoing traffic to a specific IP, run the following command on the page for netsh advfirewall

netsh advfirewall firewall add rule name="BlockOutIP" protocol=TCP dir=out remoteip=192.168.1.100 action=blockIdentify

To remove a specific firewall rule by name, run the following command on the page for netsh advfirewall

netsh advfirewall firewall delete rule name="MyRule"Identify

To find out syntax details for adding a firewall rule, run the following command on the page for netsh advfirewall

netsh advfirewall firewall add rule ?Identify

An example is here when CmdID’s reading of it names T1686.003: a Sigma rule it trips is tagged with it, or its abuse is documented as it.