Procedure examples

Qilin has the ability to clear Windows Event Logs.

HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.

Pupy has a module to clear event logs with PowerShell.

Wevtutil can be used to clear system and security event logs from the system.

Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.

TeamTNT has removed system logs from /var/log/syslog.

Rocke has cleared log files within the /var/log/ folder.

Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.

JumbledPath can clear logs on all devices used along its connection path to compromised network infrastructure.

UPSTYLE clears error logs after reading embedded commands for execution.

MacMa can clear possible malware traces such as application logs.

Proton removes logs from /var/logs and /Library/logs.

During the SolarWinds Compromise, APT29 used `netsh` to configure firewall rules that limited certain UDP outbound packets.

Leviathan modified system firewalls to add two open listening ports on 9998 and 9999 during Leviathan Australian Intrusions.

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

BlackByte modified firewall rules on victim machines to enable remote system discovery.

Kimsuky has been observed disabling the system firewall.

Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.

Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.

TeamTNT has disabled iptables.

FIN7 has added a firewall rule to allow TCP port 59999 inbound and a rule to allow sshd.exe on TCP port 9898.

Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.

UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.

Carbanak may use netsh to add local firewall rule exceptions.

Medusa Group has utilized PsExec to execute batch scripts that modify firewall settings. Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.

Prior to executing a backdoor ToddyCat has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.

Velvet Ant modified system firewall settings during PlugX installation using `netsh.exe` to open a listening, random high number port on victim devices.

Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.

Hannotog can modify local firewall settings via `netsh` commands to open a listening UDP port.

PyDCrypt has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using `netsh.exe` on remote machines.

THINCRUST can use the Django python module "django.views.decorators.csrf” along with the decorator “csrf_exempt” within victim firewalls to disable cross-site request forgery protections.

ShrinkLocker turns on the system firewall and deletes all of its rules during execution.

HOPLIGHT has modified the firewall using netsh.

InvisiMole has a command to disable routing and the Firewall on the victim’s machine.

PlugX has modified local firewall rules on victim machines to enable a random, high-number listening port for subsequent access and C2 activity.

BPFDoor starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local `iptables` rules to redirect all packets from the attacker to the shell port.

Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.

NanoCore can modify the victim's firewall.

ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.

CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.

The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.

netsh can be used to disable local firewall settings.

Pacu can allowlist IP addresses in AWS GuardDuty.

During the 2025 Poland Wiper Attacks, the adversaries modified security settings within the victims Fortigate device, utilizing the native CLI. During the 2025 Poland Wiper Attacks, the adversaries also disabled network traffic logging.

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.

Cyclops Blink can modify the Linux iptables firewall to enable C2 communication on network devices via a stored list of port numbers.

During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim's Windows firewall to set up a series of port-forwards allowing traffic to target systems.

During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.

Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.