Disable or Modify System Firewall
Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., addi...
BY SOURCE
PROCEDURES (13)
Auto-extracted: 3 detections for process creation monitoring
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for anomal
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for event log