Procedure examples

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

BlackByte modified firewall rules on victim machines to enable remote system discovery.

Kimsuky has been observed disabling the system firewall.

Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.

Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.

TeamTNT has disabled iptables.

FIN7 has added a firewall rule to allow TCP port 59999 inbound and a rule to allow sshd.exe on TCP port 9898.

Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.

UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.

Carbanak may use netsh to add local firewall rule exceptions.

Medusa Group has utilized PsExec to execute batch scripts that modify firewall settings. Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.

Prior to executing a backdoor ToddyCat has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.

Velvet Ant modified system firewall settings during PlugX installation using `netsh.exe` to open a listening, random high number port on victim devices.