Disable or Modify System Firewall: Windows Host Firewall

ID: T1686.003
Tactics: TA0112 Defense Impairment
Sub-technique of: T1686 Disable or Modify System Firewall
Platforms: Windows
Data sources: Process Creation, Windows Registry Key Modification, Windows Registry Key Creation, Service Creation, Network Connection Creation
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.^[1]

Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., netsh advfirewall or PowerShell cmdlets like Set-NetFirewallProfile, New-NetFirewallRule), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.

By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.

Detection

DET0901 Detect Windows Firewall
Data components: Process Creation, Windows Registry Key Modification, Windows Registry Key Creation, Service Creation, Network Connection Creation

Mitigations (4)

M1018 User Account Management: Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.
M1022 Restrict File and Directory Permissions: Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.
M1024 Restrict Registry Permissions: Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.
M1047 Audit: Routinely check account role permissions to ensure only expected users and roles have permission to modify system firewalls.

Groups (6)

Software (10)

References

Nearest Neighbor Volexity