ATT&CK coverage › Technique
Impair Defenses: Disable or Modify System Firewall T1562.004
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Events covered
23 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 21 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (13 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (339 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 17 rules
- A Rule Has Been Deleted From The Windows Firewall Exception List
- All Rules Have Been Deleted From The Windows Firewall Configuration
- Disable Microsoft Defender Firewall via Registry
- Disable Windows Firewall by Registry
- Firewall Disabled via Netsh.EXE
- Firewall Rule Deleted Via Netsh.EXE
- Netsh Allow Group Policy on Microsoft Defender Firewall
- New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
- New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
- New Firewall Rule Added Via Netsh.EXE
- RDP Connection Allowed Via Netsh.EXE
- Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
- The Windows Defender Firewall Service Failed To Load Group Policy
- Uncommon New Firewall Rule Added In Windows Firewall Exception List
- Windows Defender Firewall Has Been Reset To Its Default Configuration
- Windows Firewall Profile Disabled
- Windows Firewall Settings Have Been Changed