{"id":"T1686.003","name":"Windows Host Firewall","url":"https://attack.mitre.org/techniques/T1686/003","tactics":["defense-impairment"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0901","stix_id":"x-mitre-detection-strategy--488ef272-b2fa-4501-ab6e-97e3ac01816c","name":"Detect Windows Firewall","url":"https://attack.mitre.org/detectionstrategies/DET0901","analytics":[{"id":"AN2043","stix_id":"x-mitre-analytic--702db8b6-641f-4526-a0d0-a5a62c499508","name":"Analytic 2043","description":"Detects processes or users modifying Windows Defender Firewall profiles, policies, or rules followed by measurable network exposure changes. Correlates firewall management execution, registry/policy mutation, service state changes, and subsequent inbound or outbound connectivity inconsistent with baseline administration.","url":"https://attack.mitre.org/detectionstrategies/DET0901#AN2043","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=12","data_component":"DC0056","data_component_name":"Windows Registry Key Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"EventCode=7036","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=5156, 5157","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"AuthorizedAdminAccounts","description":"Known administrators allowed to manage host firewall settings"},{"field":"MaintenanceWindow","description":"Approved change windows where firewall modifications are expected"},{"field":"ExposureCorrelationWindow","description":"Time window to correlate firewall change with new connections/listeners"},{"field":"SensitivePorts","description":"Ports of concern such as RDP, SMB, WinRM, SSH, custom admin ports"},{"field":"AllowedManagementParents","description":"Expected parent processes such as SCCM, Intune agent, GPO client"},{"field":"RuleScopeThreshold","description":"Detect widening from subnet/local scope to Any/0.0.0.0/0"}],"live":true,"detection_strategies":["DET0901"],"techniques":["T1686.003"]}],"live":true,"version":"1.0","techniques":["T1686.003"]}],"sigma_rules":[{"id":"00bb5bd5-1379-4fcf-a965-a5b6f7478064","title":"Windows Firewall Settings Have Been Changed","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2022-02-19","modified":"2023-04-21","description":"Detects activity when the settings of the Windows firewall have been changed","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_setting_change.yml","techniques":["T1686.003"],"cves":[]},{"id":"01aeb693-138d-49d2-9403-c4f52d7d3d62","title":"RDP Connection Allowed Via Netsh.EXE","author":"Sander Wiebing","status":"test","level":"high","date":"2020-05-23","modified":"2023-12-11","description":"Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware","references":["https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml","techniques":["T1686.003"],"cves":[]},{"id":"04b60639-39c0-412a-9fbe-e82499c881a3","title":"Windows Defender Firewall Has Been Reset To Its Default Configuration","author":"frack113","status":"test","level":"low","date":"2022-02-19","modified":"2023-04-21","description":"Detects activity when Windows Defender Firewall has been reset to its default configuration","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_reset_config.yml","techniques":["T1686.003"],"cves":[]},{"id":"1a5fefe6-734f-452e-a07d-fc1c35bce4b2","title":"Firewall Rule Deleted Via Netsh.EXE","author":"frack113","status":"test","level":"medium","date":"2022-08-14","modified":"2025-10-07","description":"Detects the removal of a port or application rule in the Windows Firewall configuration using netsh","references":["https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml","techniques":["T1686.003"],"cves":[]},{"id":"347906f3-e207-4d18-ae5b-a9403d6bcdef","title":"Netsh Allow Group Policy on Microsoft Defender Firewall","author":"frack113","status":"test","level":"medium","date":"2022-01-09","modified":"2023-02-14","description":"Adversaries may modify system firewalls in order to bypass controls limiting network usage","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall","https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml","techniques":["T1686.003"],"cves":[]},{"id":"488b44e7-3781-4a71-888d-c95abfacf44d","title":"Windows Firewall Profile Disabled","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-10-12","modified":"2022-12-30","description":"Detects when a user disables the Windows Firewall via a Profile to help evade defense.","references":["https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps","https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell","https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php","http://woshub.com/manage-windows-firewall-powershell/","https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml","techniques":["T1686.003"],"cves":[]},{"id":"51483085-0cba-46a8-837e-4416496d6971","title":"New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet","author":"frack113","status":"test","level":"low","date":"2024-05-03","modified":null,"description":"Detects calls to the \"New-NetFirewallRule\" cmdlet from PowerShell in order to add a new firewall rule with an \"Allow\" action.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule","https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170","https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_new_netfirewallrule_allow.yml","techniques":["T1686.003"],"cves":[]},{"id":"5570c4d9-8fdd-4622-965b-403a5a101aa0","title":"Firewall Rule Modified In The Windows Firewall Exception List","author":"frack113","status":"test","level":"low","date":"2022-02-19","modified":"2024-01-22","description":"Detects when a rule has been modified in the Windows firewall exception list","references":["https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/builtin/firewall_as/win_firewall_as_change_rule.yml","techniques":["T1686.003"],"cves":[]},{"id":"57c4bf16-227f-4394-8ec7-1b745ee061c3","title":"Firewall Disabled via Netsh.EXE","author":"Fatih Sirin","status":"test","level":"medium","date":"2019-11-01","modified":"2023-02-13","description":"Detects netsh commands that turns off the Windows firewall","references":["https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/","https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003","attack.s0108"],"path":"rules/windows/process_creation/proc_creation_win_netsh_fw_disable.yml","techniques":["T1686.003"],"cves":[]},{"id":"79609c82-a488-426e-abcf-9f341a39365d","title":"All Rules Have Been Deleted From The Windows Firewall Configuration","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-17","modified":"2024-01-22","description":"Detects when a all the rules have been deleted from the Windows Defender Firewall configuration","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml","techniques":["T1686.003"],"cves":[]},{"id":"7ec15688-fd24-4177-ba43-1a950537ee39","title":"The Windows Defender Firewall Service Failed To Load Group Policy","author":"frack113","status":"test","level":"low","date":"2022-02-19","modified":"2023-01-17","description":"Detects activity when The Windows Defender Firewall service failed to load Group Policy","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml","techniques":["T1686.003"],"cves":[]},{"id":"8d31dd2e-b582-48ca-826e-dcaa2c1ca264","title":"New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock","author":"frack113","status":"test","level":"low","date":"2024-05-10","modified":null,"description":"Detects when a powershell script contains calls to the \"New-NetFirewallRule\" cmdlet in order to add a new firewall rule with an \"Allow\" action.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule","https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170","https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.defense-impairment","attack.t1686.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_new_netfirewallrule_allow.yml","techniques":["T1686.003"],"cves":[]},{"id":"974515da-6cc5-4c95-ae65-f97f9150ec7f","title":"Disable Microsoft Defender Firewall via Registry","author":"frack113","status":"test","level":"medium","date":"2022-01-09","modified":"2024-03-25","description":"Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml","techniques":["T1686.003"],"cves":[]},{"id":"9e2575e7-2cb9-4da1-adc8-ed94221dca5e","title":"New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application","author":"frack113","status":"test","level":"high","date":"2023-02-26","modified":"2024-05-10","description":"Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)","https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml","techniques":["T1686.003"],"cves":[]},{"id":"a35f5a72-f347-4e36-8895-9869b0d5fc6d","title":"Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE","author":"Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"high","date":"2020-05-25","modified":"2023-12-11","description":"Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall","references":["https://www.virusradar.com/en/Win32_Kasidet.AD/description","https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml","techniques":["T1686.003"],"cves":[]},{"id":"c187c075-bb3e-4c62-b4fa-beae0ffc211f","title":"A Rule Has Been Deleted From The Windows Firewall Exception List","author":"frack113","status":"test","level":"medium","date":"2022-02-19","modified":"2024-08-29","description":"Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml","techniques":["T1686.003"],"cves":[]},{"id":"cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c","title":"New Firewall Rule Added Via Netsh.EXE","author":"Markus Neis, Sander Wiebing","status":"test","level":"medium","date":"2019-01-29","modified":"2023-02-10","description":"Detects the addition of a new rule to the Windows firewall via netsh","references":["https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1686.003","attack.s0246"],"path":"rules/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml","techniques":["T1686.003"],"cves":[]},{"id":"cde0a575-7d3d-4a49-9817-b8004a7bf105","title":"Uncommon New Firewall Rule Added In Windows Firewall Exception List","author":"frack113","status":"test","level":"medium","date":"2022-02-19","modified":"2026-08-06","description":"Detects when a rule has been added to the Windows Firewall exception list","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_add_rule.yml","techniques":["T1686.003"],"cves":[]},{"id":"e78c408a-e2ea-43cd-b5ea-51975cf358c0","title":"Disable Windows Firewall by Registry","author":"frack113","status":"test","level":"medium","date":"2022-08-19","modified":"2023-08-17","description":"Detect set EnableFirewall to 0 to disable the Windows firewall","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.004/T1562.004.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/registry/registry_set/registry_set_disable_windows_firewall.yml","techniques":["T1686.003"],"cves":[]},{"id":"eca81e8d-09e1-4d04-8614-c91f44fd0519","title":"New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-05-10","modified":null,"description":"Detects the addition of a new \"Allow\" firewall rule by the WMI process (WmiPrvSE.EXE).\nThis can occur if an attacker leverages PowerShell cmdlets such as \"New-NetFirewallRule\", or directly uses WMI CIM classes such as \"MSFT_NetFirewallRule\".\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule","https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170","https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/"],"logsource":{"product":"windows","service":"firewall-as"},"tags":["attack.defense-impairment","attack.t1686.003"],"path":"rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml","techniques":["T1686.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}