EXPLORE
← Back to Explore
T1562.007

Disable or Modify Cloud Firewall

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permi...

IaaS
34
Detections
3
Sources
0
Threat Actors

BY SOURCE

24elastic7splunk_escu3sigma

PROCEDURES (17)

Cloud6 detections

Auto-extracted: 6 detections for cloud

Network Connection Monitoring4 detections

Auto-extracted: 4 detections for network connection monitoring

Authentication Monitoring3 detections

Auto-extracted: 3 detections for authentication monitoring

General Monitoring3 detections

Auto-extracted: 3 detections for general monitoring

Ransomware2 detections

Auto-extracted: 2 detections for ransomware

Service2 detections

Auto-extracted: 2 detections for service

Bypass2 detections

Auto-extracted: 2 detections for bypass

Azure2 detections

Auto-extracted: 2 detections for azure

Aws2 detections

Auto-extracted: 2 detections for aws

C21 detections

Auto-extracted: 1 detections for c2

Persist1 detections

Auto-extracted: 1 detections for persist

Bypass1 detections

Auto-extracted: 1 detections for bypass

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Evasion1 detections

Auto-extracted: 1 detections for evasion

C21 detections

Auto-extracted: 1 detections for c2

Evasion1 detections

Auto-extracted: 1 detections for evasion

Persist1 detections

Auto-extracted: 1 detections for persist

DETECTIONS (34)

Allow File And Printing Sharing In Firewall
splunk_escu
Allow Network Discovery In Firewall
splunk_escu
ASL AWS Network Access Control List Created with All Open Ports
splunk_escu
ASL AWS Network Access Control List Deleted
splunk_escu
Attempt to Deactivate an Okta Network Zone
elasticmedium
Attempt to Deactivate an Okta Policy
elasticlow
Attempt to Deactivate an Okta Policy Rule
elasticmedium
Attempt to Delete an Okta Network Zone
elasticmedium
Attempt to Delete an Okta Policy
elasticmedium
Attempt to Delete an Okta Policy Rule
elasticlow
Attempt to Modify an Okta Network Zone
elasticmedium
Attempt to Modify an Okta Policy
elasticlow
Attempt to Modify an Okta Policy Rule
elasticlow
AWS EC2 Network Access Control List Creation
elasticlow
AWS EC2 Network Access Control List Deletion
elasticmedium
AWS EC2 Security Group Configuration Change
elasticlow
AWS Network Access Control List Created with All Open Ports
splunk_escu
AWS Network Access Control List Deleted
splunk_escu
AWS WAF Access Control List Deletion
elasticmedium
AWS WAF Rule or Rule Group Deletion
elasticmedium
Azure Network Firewall Policy Modified or Deleted
sigmamedium
Azure VNet Firewall Front Door WAF Policy Deleted
elasticlow
Azure VNet Firewall Policy Deleted
elasticlow
Domain Added to Google Workspace Trusted Domains
elastichigh
GCP Firewall Rule Creation
elasticlow
GCP Firewall Rule Deletion
elasticmedium
GCP Firewall Rule Modification
elasticmedium
GCP Virtual Private Cloud Network Deletion
elasticmedium
GCP Virtual Private Cloud Route Creation
elasticlow
GCP Virtual Private Cloud Route Deletion
elasticmedium
Insecure AWS EC2 VPC Security Group Ingress Rule Added
elasticmedium
New Network ACL Entry Added
sigmalow
New Network Route Added
sigmamedium
O365 Bypass MFA via Trusted IP
splunk_escu