Detect Disable or Modify Network Device Firewall in Microsoft Sentinel
Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Modifying or disabling a network firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Adversaries may gain access to the firewall management console via Valid Accounts or by exploiting a vulnerability. In some cases, threat actors may target firewalls that have been exposed to the internet. This technique was used by APT38 to create firewall exemptions on specific ports, and by threat actors exploiting Fortinet FortiGate vulnerabilities (CVE-2024-55591) to modify firewall rules before deploying LockBit ransomware.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.013 Disable or Modify Network Device Firewall
- Canonical reference
- https://attack.mitre.org/techniques/T1562/013/
KQL Detection Query
let FirewallCommands = dynamic([
"netsh advfirewall", "netsh firewall",
"Set-NetFirewallProfile", "New-NetFirewallRule",
"Remove-NetFirewallRule", "Set-NetFirewallRule",
"Disable-NetFirewallRule", "netsh advfirewall set allprofiles state off",
"netsh advfirewall firewall add rule",
"iptables -F", "iptables -P INPUT ACCEPT",
"iptables -P FORWARD ACCEPT", "iptables -D",
"ufw disable", "firewall-cmd --permanent --add-port",
"nft flush ruleset", "nft delete"
]);
let NetworkDeviceSyslog = dynamic([
"firewall rule", "access-list", "security-policy",
"policy delete", "rule delete", "permit any any",
"action accept", "config firewall policy"
]);
union
(
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (FirewallCommands)
| extend IsFirewallDisable = ProcessCommandLine has_any ("state off", "set allprofiles state off", "Enabled False", "-F", "flush", "disable")
| extend IsRuleAdd = ProcessCommandLine has_any ("add rule", "New-NetFirewallRule", "-A INPUT", "-I INPUT", "--add-port", "nft add")
| extend IsRuleDelete = ProcessCommandLine has_any ("delete rule", "Remove-NetFirewallRule", "-D INPUT", "nft delete")
| extend AllowsAny = ProcessCommandLine has_any ("action=allow", "-j ACCEPT", "ACCEPT", "permit", "allow")
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName,
InitiatingProcessCommandLine,
IsFirewallDisable, IsRuleAdd, IsRuleDelete, AllowsAny,
DetectionType="HostFirewallManipulation"
),
(
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any (NetworkDeviceSyslog)
| where SyslogMessage has_any ("delete", "disable", "permit any", "accept", "removed", "modified")
| project TimeGenerated, Computer, HostName, Facility,
SeverityLevel, SyslogMessage,
DetectionType="NetworkDeviceFirewallChange"
),
(
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor in ("Fortinet", "Palo Alto Networks", "Cisco", "Check Point")
| where Activity has_any ("policy", "rule", "firewall", "security")
| where Activity has_any ("delete", "modify", "disable", "create", "add")
| project TimeGenerated, DeviceVendor, DeviceProduct,
SourceUserName, SourceIP, Activity, Message,
DetectionType="NetworkFirewallPolicyChange"
)
| sort by TimeGenerated descDetects network firewall manipulation across three tiers: (1) Host-based firewall changes on Windows (netsh, PowerShell *-NetFirewall* cmdlets) and Linux (iptables, ufw, nft, firewall-cmd); (2) Network device syslog messages indicating firewall rule changes from routers, switches, and dedicated firewall appliances; (3) CommonSecurityLog entries from enterprise firewall vendors (Fortinet, Palo Alto, Cisco, Check Point) showing policy modifications. Flags whether the change disables the firewall entirely, adds permissive rules, or deletes existing rules.
Data Sources
Required Tables
False Positives & Tuning
- Network administrators making planned firewall changes during a documented maintenance window — correlate with change management tickets
- Infrastructure-as-code deployments (Terraform, Ansible, CloudFormation) that modify firewall rules as part of automated provisioning
- Software installation scripts that add Windows Firewall exceptions for newly installed applications (e.g., SQL Server, IIS, Docker)
- VPN or remote access solutions that dynamically add firewall rules when users connect (Cisco AnyConnect, GlobalProtect, Tailscale)
Other platforms for T1562.013
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Disable Windows Firewall via netsh
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine='advfirewall set allprofiles state off'. Windows Firewall Event ID 2003: Profile changed (all profiles disabled). Security Event ID 4688 with command line auditing. DeviceProcessEvents in MDE.
- Test 2Add Allow-Any Inbound Firewall Rule via netsh
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'add rule' and 'action=allow'. Windows Firewall Event ID 2004: New rule added. DeviceProcessEvents in MDE with full command line details.
- Test 3Flush Linux iptables Rules
Expected signal: Syslog and/or Sysmon for Linux process creation events for iptables with -F, -P INPUT ACCEPT, and -P FORWARD ACCEPT arguments. Linux audit events (SYSCALL) for the iptables binary execution. The network exposure is immediate.
- Test 4Disable UFW Firewall on Linux
Expected signal: Syslog entry for 'ufw disable' command. Process creation event for the ufw binary. Systemd journal entry for the ufw service state change. Sysmon for Linux (if installed) Event ID 1 for process creation.
References (7)
- https://attack.mitre.org/techniques/T1562/013/
- https://posts.inthecyber.com/exposed-fortinet-fortigate-firewall-interface-leads-to-lockbit-ransomware-cve-2024-55591-de8fcfb6c45c
- https://nvd.nist.gov/vuln/detail/CVE-2024-55591
- https://us-cert.cisa.gov/ncas/alerts/aa20-239a
- https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/
- https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/
- https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring
Unlock Pro Content
Get the full detection package for T1562.013 including response playbook, investigation guide, and atomic red team tests.