{"id":"T1686.001","name":"Cloud Firewall","url":"https://attack.mitre.org/techniques/T1686/001","tactics":["defense-impairment"],"platforms":["IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0424","stix_id":"x-mitre-detection-strategy--1221d0cb-6404-4fe7-837e-6057a96e7acb","name":"Detection Strategy for Disable or Modify Cloud Firewall","url":"https://attack.mitre.org/detectionstrategies/DET0424","analytics":[{"id":"AN1188","stix_id":"x-mitre-analytic--ee7c904b-144f-4dc4-87af-7eee4655899c","name":"Analytic 1188","description":"Creation, deletion, or modification of security groups and firewall rules in cloud control plane logs that expand access to cloud resources beyond expected baselines. Defender view: unexpected ingress/egress rules permitting 0.0.0.0/0 or opening atypical ports, often correlated with privileged role or API key activity.","url":"https://attack.mitre.org/detectionstrategies/DET0424#AN1188","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"Ingress rule creation or modification for security group","data_component":"DC0051","data_component_name":"Firewall Rule Modification","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"Removal of restrictive egress rules from a security group","data_component":"DC0043","data_component_name":"Firewall Disable","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"AllowedIPRanges","description":"Whitelist approved IP ranges; detect unexpected addition of 0.0.0.0/0 or untrusted CIDRs."},{"field":"PortScope","description":"Define expected ports for services; flag additions outside this range (e.g., SSH/RDP open to all)."},{"field":"RoleContext","description":"Tune alerts based on whether changes are made by break-glass or admin roles versus automation accounts."},{"field":"TimeWindow","description":"Correlate rule changes with subsequent suspicious network activity to reduce false positives."}],"live":true,"detection_strategies":["DET0424"],"techniques":["T1686.001"]}],"live":true,"version":"1.0","techniques":["T1686.001"]}],"sigma_rules":[{"id":"025c9fe7-db72-49f9-af0d-31341dd7dd57","title":"Azure Firewall Rule Collection Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-08","modified":"2022-08-23","description":"Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.defense-impairment","attack.t1686.001"],"path":"rules/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml","techniques":["T1686.001"],"cves":[]},{"id":"512cf937-ea9b-4332-939c-4c2c94baadcd","title":"Azure Firewall Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-08","modified":"2022-08-23","description":"Identifies when a firewall is created, modified, or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.defense-impairment","attack.t1686.001"],"path":"rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml","techniques":["T1686.001"],"cves":[]},{"id":"83c17918-746e-4bd9-920b-8e098bf88c23","title":"Azure Network Firewall Policy Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-09-02","modified":"2022-08-23","description":"Identifies when a Firewall Policy is Modified or Deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.defense-impairment","attack.t1686.001"],"path":"rules/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml","techniques":["T1686.001"],"cves":[]},{"id":"c803b2ce-c4a2-4836-beae-b112010390b1","title":"New Network Route Added","author":"jamesc-grafana","status":"test","level":"medium","date":"2024-07-11","modified":null,"description":"Detects the addition of a new network route to a route table in AWS.\n","references":["https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.defense-impairment","attack.t1686.001"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml","techniques":["T1686.001"],"cves":[]},{"id":"e1f7febb-7b94-4234-b5c6-00fb8500f5dd","title":"New Network ACL Entry Added","author":"jamesc-grafana","status":"test","level":"low","date":"2024-07-11","modified":null,"description":"Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.\n","references":["https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.defense-impairment","attack.t1686.001"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml","techniques":["T1686.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}