CmdID

CmdID / Techniques

T1686 Disable or Modify System Firewall

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. MITRE ATT&CK

3 Sigma rules T1686 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1686.003Disable or Modify System Firewall: Windows Host Firewall

Sigma rules tagged with it

process creation, the highest levels first
mediumDisabling Security ToolsÖmer Günal, Alejandro Ortuno, oscd.community · Linux
mediumFlush Iptables Ufw ChainJoseliyo Sanchez, @Joseliyo_Jstnk · Linux
mediumUFW Disable AttemptJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Put SELinux in permissive mode on the page for setenforce

setenforce 0Identify

Simulate disabling the firewall without making changes on the page for ufw-disable

sudo ufw --dry-run disableIdentify

Unload and disable ufw on the page for ufw-disable

sudo ufw disableIdentify

An example is here when CmdID’s reading of it names T1686: a Sigma rule it trips is tagged with it, or its abuse is documented as it.