# T1686 - Disable or Modify System Firewall

## Description from ATT&CK

> Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti)
> 
> Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)

[Source](https://attack.mitre.org/techniques/T1686)

## Atomic Tests

- [Atomic Test #1: Disable Microsoft Defender Firewall](#atomic-test-1-disable-microsoft-defender-firewall)
- [Atomic Test #2: Disable Microsoft Defender Firewall via Registry](#atomic-test-2-disable-microsoft-defender-firewall-via-registry)
- [Atomic Test #3: Allow SMB and RDP on Microsoft Defender Firewall](#atomic-test-3-allow-smb-and-rdp-on-microsoft-defender-firewall)
- [Atomic Test #4: Opening ports for proxy - HARDRAIN](#atomic-test-4-opening-ports-for-proxy---hardrain)
- [Atomic Test #5: Open a local port through Windows Firewall to any profile](#atomic-test-5-open-a-local-port-through-windows-firewall-to-any-profile)
- [Atomic Test #6: Allow Executable Through Firewall Located in Non-Standard Location](#atomic-test-6-allow-executable-through-firewall-located-in-non-standard-location)
- [Atomic Test #7: Stop/Start UFW firewall](#atomic-test-7-stopstart-ufw-firewall)
- [Atomic Test #8: Stop/Start Packet Filter](#atomic-test-8-stopstart-packet-filter)
- [Atomic Test #9: Stop/Start UFW firewall systemctl](#atomic-test-9-stopstart-ufw-firewall-systemctl)
- [Atomic Test #10: Turn off UFW logging](#atomic-test-10-turn-off-ufw-logging)
- [Atomic Test #11: Add and delete UFW firewall rules](#atomic-test-11-add-and-delete-ufw-firewall-rules)
- [Atomic Test #12: Add and delete Packet Filter rules](#atomic-test-12-add-and-delete-packet-filter-rules)
- [Atomic Test #13: Edit UFW firewall user.rules file](#atomic-test-13-edit-ufw-firewall-userrules-file)
- [Atomic Test #14: Edit UFW firewall ufw.conf file](#atomic-test-14-edit-ufw-firewall-ufwconf-file)
- [Atomic Test #15: Edit UFW firewall sysctl.conf file](#atomic-test-15-edit-ufw-firewall-sysctlconf-file)
- [Atomic Test #16: Edit UFW firewall main configuration file](#atomic-test-16-edit-ufw-firewall-main-configuration-file)
- [Atomic Test #17: Tail the UFW firewall log file](#atomic-test-17-tail-the-ufw-firewall-log-file)
- [Atomic Test #18: Disable iptables](#atomic-test-18-disable-iptables)
- [Atomic Test #19: Modify/delete iptables firewall rules](#atomic-test-19-modifydelete-iptables-firewall-rules)
- [Atomic Test #20: LockBit Black - Unusual Windows firewall registry modification -cmd](#atomic-test-20-lockbit-black---unusual-windows-firewall-registry-modification--cmd)
- [Atomic Test #21: LockBit Black - Unusual Windows firewall registry modification -Powershell](#atomic-test-21-lockbit-black---unusual-windows-firewall-registry-modification--powershell)
- [Atomic Test #22: Blackbit - Disable Windows Firewall using netsh firewall](#atomic-test-22-blackbit---disable-windows-firewall-using-netsh-firewall)
- [Atomic Test #23: ESXi - Disable Firewall via Esxcli](#atomic-test-23-esxi---disable-firewall-via-esxcli)
- [Atomic Test #24: Set a firewall rule using New-NetFirewallRule](#atomic-test-24-set-a-firewall-rule-using-new-netfirewallrule)
- [Atomic Test #25: ESXi - Set Firewall to PASS Traffic](#atomic-test-25-esxi---set-firewall-to-pass-traffic)

### Atomic Test #1: Disable Microsoft Defender Firewall

Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...

**Supported Platforms:** Windows

**auto_generated_guid:** `88d05800-a5e4-407e-9b53-ece4174f197f`

#### Attack Commands: Run with `command_prompt`!

```cmd
netsh advfirewall set currentprofile state off
```

#### Cleanup Commands

```cmd
netsh advfirewall set currentprofile state on >nul 2>&1
```
### Atomic Test #2: Disable Microsoft Defender Firewall via Registry

Disables the Microsoft Defender Firewall for the public profile via registry
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...

**Supported Platforms:** Windows

**auto_generated_guid:** `afedc8c4-038c-4d82-b3e5-623a95f8a612`

#### Attack Commands: Run with `command_prompt`!

```cmd
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
```

#### Cleanup Commands

```cmd
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 1 /f
```
### Atomic Test #3: Allow SMB and RDP on Microsoft Defender Firewall

Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...

**Supported Platforms:** Windows

**auto_generated_guid:** `d9841bf8-f161-4c73-81e9-fd773a5ff8c1`

#### Attack Commands: Run with `command_prompt`!

```cmd
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes
```

#### Cleanup Commands

```cmd
netsh advfirewall reset >nul 2>&1
```
### Atomic Test #4: Opening ports for proxy - HARDRAIN

This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf

**Supported Platforms:** Windows

**auto_generated_guid:** `15e57006-79dd-46df-9bf9-31bc24fb5a80`

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
netsh advfirewall firewall add rule name="atomic testing" action=allow dir=in protocol=TCP localport=450
```

#### Cleanup Commands

```cmd
netsh advfirewall firewall delete rule name="atomic testing" protocol=TCP localport=450 >nul 2>&1
```
### Atomic Test #5: Open a local port through Windows Firewall to any profile

This test will attempt to open a local port defined by inpu