Procedure examples

OilRig has modified Windows firewall rules to enable remote access.

MirrorFace can modify the system firewall to allow communication to certain ports.

Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.

VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.

BlackByte 2.0 Ransomware modifies the Windows firewall during execution.

DarkComet can disable Security Center functions like the Windows Firewall.

Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.

TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.

BADCALL disables the Windows firewall before binding to a port.

HiddenFace can reconfigure Windows firewalls to enable communication by adding a rule named “Cortana” to allow inbound connection to TCP/47000.

HARDRAIN opens the Windows Firewall to modify incoming connections.

njRAT has modified the Windows firewall to allow itself to communicate through the firewall.

H1N1 kills and disables services for Windows Firewall.

AvosLocker can restart a compromised machine in safe mode.

RansomHub can reboot targeted systems into Safe Mode prior to encryption.

LockBit 3.0 can reboot the infected host into Safe Mode.

Embargo has used a DLL variant of MDeployer to disable security solutions through Safe Mode.

Black Basta can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`.

REvil can force a reboot in safe mode with networking.

Qilin can reboot targeted systems in safe mode to avoid detection.

During FrostyGoop Incident, the adversary downgraded firmware on victim devices in order to impair visibility into the process environment.

BlackByte Ransomware enables SMBv1 during execution.

SILENTTRINITY can downgrade NTLM to capture NTLM hashes.

During RedPenguin, UNC3886 used malware to clear the `HISTFILE` environmental variable and to inject into Junos OS processes to inhibit logging.

ArcaneDoor included disabling logging on targeted Cisco ASA appliances.

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.

UNC3886 has tampered with and disabled logging services on targeted systems.

Sea Turtle unset the Bash and MySQL history files on victim systems.

Medusa Group has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.

BRICKSTORM has impaired command logging through the use of `dev/null` which prevents generating output from the command and does not wait for input.

Line Dancer can disable syslog on compromised devices.

BPFDoor sets the `MYSQL_HISTFILE` and `HISTFILE` to `/dev/null` preventing the shell and MySQL from logging history in `/proc/<PID>/environ`.

SPAWNCHIMERA has disabled logging and log forwarding on Ivanti devices targeting the `dslogserver` process.

VIRTUALPITA can impair logging by setting the `HISTFILE` environmental variable to `0` and stopping the `vmsyslogd` service.

SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.