Windows Host Firewall
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries ma...
BY SOURCE
PROCEDURES (11)
Auto-extracted: 7 detections for general monitoring
Auto-extracted: 4 detections for process creation monitoring
Auto-extracted: 1 detections for registry monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for bypass