Windows Host Firewall

T1686.003

Sub-technique of T1686 Disable or Modify System Firewall.View on attack.mitre.org

About this technique

Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.

Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.

By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.

Detection rules17

Rules on DetectionCode tagged with T1686.003.

Sigma17

Rule	Level	Log source
All Rules Have Been Deleted From The Windows Firewall Configuration	high	windows / NULL
New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application	high	windows / NULL
RDP Connection Allowed Via Netsh.EXE	high	windows / process_creation
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE	high	windows / process_creation
A Rule Has Been Deleted From The Windows Firewall Exception List	medium	windows / NULL
Disable Microsoft Defender Firewall via Registry	medium	windows / registry_set
Disable Windows Firewall by Registry	medium	windows / registry_set
Firewall Disabled via Netsh.EXE	medium	windows / process_creation
Firewall Rule Deleted Via Netsh.EXE	medium	windows / process_creation
Netsh Allow Group Policy on Microsoft Defender Firewall	medium	windows / process_creation
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE	medium	windows / NULL
New Firewall Rule Added Via Netsh.EXE	medium	windows / process_creation
Uncommon New Firewall Rule Added In Windows Firewall Exception List	medium	windows / NULL
Windows Firewall Profile Disabled	medium	windows / ps_script
The Windows Defender Firewall Service Failed To Load Group Policy	low	windows / NULL
Windows Defender Firewall Has Been Reset To Its Default Configuration	low	windows / NULL
Windows Firewall Settings Have Been Changed	low	windows / NULL

Splunk0

No Splunk rules are mapped to this technique yet.

Groups6

Software9

BADCALL BlackByte 2.0 Ransomware DarkComet H1N1 HARDRAIN HiddenFace njRAT Remsec TYPEFRAME

Campaigns2

APT28 Nearest Neighbor Campaign Operation Wocao

Procedure examples17

Groups6

Used by	Procedure example
GroupLazarus Group	Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. Novetta Blockbuster Novetta Blockbuster Loaders Novetta Blockbuster Tools
GroupMagic Hound	Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`. DFIR Phosphorus November 2021 DFIR Report APT35 ProxyShell March 2022
GroupMirrorFace	MirrorFace can modify the system firewall to allow communication to certain ports. JPCERT MirrorFace JUL 2024
GroupMoses Staff	Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines. Checkpoint MosesStaff Nov 2021
GroupOilRig	OilRig has modified Windows firewall rules to enable remote access. Symantec Crambus OCT 2023
GroupVOID MANTICORE	VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host. Check Point VOID MANTICORE Handala Hack March 2026

Software9

Used by	Procedure example
MalwareBADCALL	BADCALL disables the Windows firewall before binding to a port. US-CERT BADCALL
MalwareBlackByte 2.0 Ransomware	BlackByte 2.0 Ransomware modifies the Windows firewall during execution. Microsoft BlackByte 2023
MalwareDarkComet	DarkComet can disable Security Center functions like the Windows Firewall. Malwarebytes DarkComet March 2018 TrendMicro DarkComet Sept 2014
MalwareH1N1	H1N1 kills and disables services for Windows Firewall. Cisco H1N1 Part 2
MalwareHARDRAIN	HARDRAIN opens the Windows Firewall to modify incoming connections. US-CERT HARDRAIN March 2018
MalwareHiddenFace	HiddenFace can reconfigure Windows firewalls to enable communication by adding a rule named “Cortana” to allow inbound connection to TCP/47000. ESET HiddenFace 2024 Trend Micro Earth Kasha NOV 2024
MalwarenjRAT	njRAT has modified the Windows firewall to allow itself to communicate through the firewall. Fidelis njRAT June 2013 Trend Micro njRAT 2018
MalwareRemsec	Remsec can add or remove applications or ports on the Windows firewall or disable it entirely. Kaspersky ProjectSauron Technical Analysis

View all 9 software examples

Campaigns2

Used by	Procedure example
CampaignAPT28 Nearest Neighbor Campaign	During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim's Windows firewall to set up a series of port-forwards allowing traffic to target systems. Nearest Neighbor Volexity
CampaignOperation Wocao	During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall. FoxIT Wocao December 2019

References1

Nearest Neighbor Volexity Open source
Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.