CyberStack

MITRE ATT&CK / Techniques / T1686

Disable or Modify System Firewall

ID
T1686
Tactics
TA0112 Defense Impairment
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Data sources
Process Creation, Windows Registry Key Modification, Command Execution, Firewall Rule Modification
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.[1]

Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.[2][3]

Sub-techniques (3)

Detection

Mitigations (4)

M1018 User Account Management

Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.

M1022 Restrict File and Directory Permissions

Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.

M1024 Restrict Registry Permissions

Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.

M1047 Audit

Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls.

Groups (13)

Software (15)

References

  1. change_rdp_port_conti
  2. Broadcom ESXi Firewall
  3. Trellix Rnasomhouse 2024