Disable or Modify System Firewall
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel. Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would o...
BY SOURCE
PROCEDURES (25)
Auto-extracted: 7 detections for general monitoring
Auto-extracted: 7 detections for process creation monitoring
Auto-extracted: 5 detections for network connection monitoring
Auto-extracted: 2 detections for anomal
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for lateral
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for registry monitoring