AN0855 Analytic 0855

Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Defender observes configuration changes on firewall/network appliance involving rule creation, modification, or deletion from abnormal management IPs or non-console channels (e.g., remote CLI, API). These are often correlated with a spike in previously blocked outbound traffic, unexpected allow-all rules, or bulk rule deletions. Behavior often follows unauthorized login, privilege escalation, or API abuse.</p>

Detects: T1686.002 Network Device Firewall
Part of: DET0306 Detection of Unauthorized Network Firewall Rule Modification

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
networkdevice:Firewall	`update_rule: Access control or NAT rule modified or disabled outside maintenance window`	DC0051 Firewall Rule Modification
networkdevice:Firewall	`Login from untrusted IP, or new admin account accessing firewall console/API`	DC0067 Logon Session Creation
networkdevice:Firewall	`Audit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config`	DC0064 Command Execution
NSM:Flow	`Outbound traffic spike through formerly blocked ports/subnets following config change`	DC0082 Network Connection Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TrustedAdminIPs`	Allowlisted IPs/subnets where administrative access is expected (e.g., jump box, VPN mgmt)
`ConfigChangeWindow`	Expected maintenance window (e.g., 02:00–04:00 UTC) to filter benign changes
`RuleScopeThreshold`	Number of rules affected or port ranges modified to determine severity
`NewUserPrivilegeThreshold`	Flag new users making changes without observed privilege elevation path