| name | T1562.004_disable-or-modify-system-firewall |
| description | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1562.004","defense-evasion","esxi","linux","macos","network-devices","windows","sub-technique"] |
| technique_id | T1562.004 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["ESXi","Linux","macOS","Network Devices","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1562/004 |
| tech_stack | ["esxi","linux","macos","network devices","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1562","T1562.001","T1562.002","T1562.003","T1562.006","T1562.007","T1562.008","T1562.009","T1562.010","T1562.011","T1562.012","T1562.013"] |
| prerequisites | ["T1562"] |
| severity_boost | {"T1562":"Chain with T1562 for deeper attack path","T1562.001":"Chain with T1562.001 for deeper attack path","T1562.002":"Chain with T1562.002 for deeper attack path"} |
T1562.004 Disable or Modify System Firewall
Sub-technique of: T1562
High-Level Description
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. Non-Standard Port).
Adversaries may also modify host networking settings that indirectly manipulate system firewalls, such as interface bandwidth or network connection request thresholds. Settings related to enabling abuse of various Remote Services may also indirectly modify firewall rules.
In ESXi, firewall rules may be modified directly via the esxcli command line interface (e.g., via esxcli network firewall set) or via the vCenter user interface.
Kill Chain Phase
Platforms: ESXi, Linux, macOS, Network Devices, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Disable Microsoft Defender Firewall
Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
