type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--d2ff4b56-8351-4ed8-b0fb-d8605366005f
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0051
external_id: DC0051
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:37.073Z
name: Firewall Rule Modification
description: The creation, deletion, or alteration of firewall rules to allow or block specific network traffic. Monitoring changes to these rules is critical for detecting misconfigurations, unauthorized access, or malicious attempts to bypass network protections. Examples: 

- Rule Creation: Adding a new rule to allow inbound traffic on port 3389 (RDP).
- Rule Deletion: Deleting a rule that blocks inbound traffic from untrusted IP ranges.
- Rule Modification: Changing a rule to allow traffic from "any" source IP instead of a specific trusted range.
- Audit Log Metadata: Logs indicating "Firewall rule modified by admin@domain.com."
- Platform-Specific Scenarios
 - Azure: Altering rules in an Azure Network Security Group (NSG).
 - AWS: Modifying Security Group rules to allow traffic.
 - Windows: Changes tracked in Security Event Logs (EID 4950 or 4951).

This data component can be collected through the following measures:

Cloud Control Plane

- Azure: Collect rule modification logs from Azure Firewall Activity Logs.
 - Example Command: `az network firewall policy rule-collection-group rule-collection list --policy-name `
- AWS: Use CloudTrail to track `AuthorizeSecurityGroupIngress` or `RevokeSecurityGroupIngress` actions.
 Example: `aws ec2 describe-security-groups`
- Google Cloud: Use gcloud commands to extract firewall rules: `gcloud compute firewall-rules list --format=json`

Host-Based Firewalls

- Windows: 
 - Collect events from the Windows Security Event Log (EID 4950: A rule has been modified).
 - Use PowerShell to track rule changes: `Get-NetFirewallRule -PolicyStore PersistentStore`
- Linux:
 - Monitor iptables or nftables rule modifications: `iptables -L -v`
 - Use auditd for real-time monitoring: `auditctl -w /etc/iptables.rules -p wa`
- macOS: Use pfctl to monitor rule changes: `sudo pfctl -sr`

SIEM Integration

- Collect logs from cloud platforms, host systems, and network appliances for centralized monitoring.

API Monitoring

- Monitor API calls for firewall rule modifications.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: Firewall Rule Modification
name: Firewall Audit Logs
channel: Config Change
name: esxi:hostd
channel: vSphere API calls modifying firewall settings
name: networkdevice:cli
channel: firewall disable commands or suspicious ACL modifications
name: AWS:CloudTrail
channel: AuthorizeSecurityGroupIngress
name: WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
channel: new rule allowing inbound or outbound connections for remote desktop software
name: networkdevice:Firewall
channel: update_rule: Access control or NAT rule modified or disabled outside maintenance window
name: linux:syslog
channel: iptables or nftables rule changes
name: Firewall Audit Logs
channel: Outbound NAT Rule Changes
name: AWS:CloudTrail
channel: Create egress rule allowing UDP to port 53, 123, 11211
name: AWS:CloudTrail
channel: Ingress rule creation or modification for security group
name: AWS:CloudTrail
channel: New security group created with permissive rules
name: NSM:Firewall
channel: Policy Change / Rule Update
name: NSM:Firewall
channel: rule_modification: New or modified firewall rules related to wireless interfaces