Procedure examples

Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.

TeamTNT has removed system logs from /var/log/syslog.

Rocke has cleared log files within the /var/log/ folder.

Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

BlackByte modified firewall rules on victim machines to enable remote system discovery.

Kimsuky has been observed disabling the system firewall.

Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.

Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.

TeamTNT has disabled iptables.

FIN7 has added a firewall rule to allow TCP port 59999 inbound and a rule to allow sshd.exe on TCP port 9898.

Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.

UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.

Carbanak may use netsh to add local firewall rule exceptions.

Medusa Group has utilized PsExec to execute batch scripts that modify firewall settings. Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.

Prior to executing a backdoor ToddyCat has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.

Velvet Ant modified system firewall settings during PlugX installation using `netsh.exe` to open a listening, random high number port on victim devices.

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.

OilRig has modified Windows firewall rules to enable remote access.

MirrorFace can modify the system firewall to allow communication to certain ports.

Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.

VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.

UNC3886 has tampered with and disabled logging services on targeted systems.

Sea Turtle unset the Bash and MySQL history files on victim systems.

Medusa Group has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.