Which SIEM platforms have a T1686 detection rule?

df00tech provides T1686 (Disable or Modify System Firewall) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1686 detection?

The T1686 detection is rated high severity with high confidence.

What are common false positives for T1686?

Common false positives for T1686 include: System administrators legitimately configuring firewall rules for new application deployments; Automated deployment tools (Ansible, Puppet, Chef) that manage firewall rules as part of infrastructure-as-code; Network troubleshooting where firewall is temporarily disabled and re-enabled within a change window.

T1686

Disable or Modify System Firewall

Q: What data sources are required to detect Disable or Modify System Firewall (T1686)?

Detecting Disable or Modify System Firewall requires the following data sources: Process: Process Creation, Command: Command Execution, Firewall: Firewall Rule Modification, Firewall: Firewall Disable.

Defense Impairment Last updated: April 20, 2026

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done via command-line tools (netsh, iptables, ufw, pfctl), editing Windows Registry keys, or through the Windows Control Panel. On ESXi, firewall rules may be modified via esxcli. Adversaries may add new firewall rules for RDP on non-standard ports or open all traffic to enable C2, lateral movement, and data exfiltration.

What is T1686 Disable or Modify System Firewall?

Disable or Modify System Firewall (T1686) maps to the Defense Impairment tactic — the adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening in MITRE ATT&CK.

This page provides production-ready detection logic for Disable or Modify System Firewall, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Firewall: Firewall Rule Modification, Firewall: Firewall Disable. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Defense Impairment
Technique: T1686 Disable or Modify System Firewall
Canonical reference: https://attack.mitre.org/techniques/T1686/

Microsoft Sentinel / Defender

kusto

let FirewallCommands = dynamic(["netsh advfirewall set", "netsh advfirewall firewall add", "netsh advfirewall firewall delete", "netsh firewall set opmode disable", "Set-NetFirewallProfile -Enabled False", "Set-NetFirewallProfile -All -Enabled False", "New-NetFirewallRule", "Remove-NetFirewallRule", "iptables -F", "iptables -X", "iptables -P INPUT ACCEPT", "iptables -P FORWARD ACCEPT", "ufw disable", "pfctl -d", "esxcli network firewall set"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (FirewallCommands)
| extend FirewallAction = case(
    ProcessCommandLine has "set allprofiles state off" or ProcessCommandLine has "opmode disable" or ProcessCommandLine has "-Enabled False" or ProcessCommandLine has "ufw disable" or ProcessCommandLine has "pfctl -d", "Firewall Disabled",
    ProcessCommandLine has "firewall add" or ProcessCommandLine has "New-NetFirewallRule", "Rule Added",
    ProcessCommandLine has "firewall delete" or ProcessCommandLine has "Remove-NetFirewallRule", "Rule Deleted",
    ProcessCommandLine has "iptables -F" or ProcessCommandLine has "iptables -X", "IPTables Flushed",
    ProcessCommandLine has "iptables -P" and ProcessCommandLine has "ACCEPT", "IPTables Policy Set to ACCEPT",
    "Other Modification")
| extend RuleDetail = extract(@"(?:rule\s+name=|--dport\s+)(\"?[^\"\s]+\"?)", 1, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FirewallAction, RuleDetail, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Detects system firewall disablement and rule modification across Windows (netsh, PowerShell NetFirewall cmdlets), Linux (iptables, ufw), macOS (pfctl), and ESXi (esxcli). Classifies the action type (disabled, rule added/deleted, policy flushed) for triage prioritization.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Firewall: Firewall Rule Modification Firewall: Firewall Disable

Required Tables

DeviceProcessEvents

False Positives

System administrators legitimately configuring firewall rules for new application deployments
Automated deployment tools (Ansible, Puppet, Chef) that manage firewall rules as part of infrastructure-as-code
Network troubleshooting where firewall is temporarily disabled and re-enabled within a change window
Application installers that add firewall exceptions during setup (e.g., SQL Server, IIS)

Splunk

spl

(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (CommandLine="*netsh advfirewall set*state off*" OR CommandLine="*netsh advfirewall firewall add*" OR CommandLine="*netsh advfirewall firewall delete*" OR CommandLine="*netsh firewall set opmode disable*" OR CommandLine="*Set-NetFirewallProfile*Enabled*False*" OR CommandLine="*New-NetFirewallRule*" OR CommandLine="*Remove-NetFirewallRule*"))
OR
(index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" EventCode IN (2003, 2004, 2005, 2006, 2033))
OR
(index=linux sourcetype=syslog ("iptables -F" OR "iptables -X" OR "iptables -P INPUT ACCEPT" OR "ufw disable" OR "pfctl -d"))
| eval FirewallAction=case(
    EventCode==2003, "Firewall Profile Changed",
    EventCode==2004, "Firewall Rule Added",
    EventCode==2005, "Firewall Rule Modified",
    EventCode==2006, "Firewall Rule Deleted",
    EventCode==2033, "Firewall Rule Modified (2033)",
    match(_raw, "(?i)(state off|opmode disable|Enabled.*False|ufw disable|pfctl -d)"), "Firewall Disabled",
    match(_raw, "(?i)(iptables -F|iptables -X)"), "IPTables Flushed",
    match(_raw, "(?i)iptables -P.*ACCEPT"), "IPTables Accept All",
    match(_raw, "(?i)(firewall add|New-NetFirewallRule)"), "Rule Added",
    true(), "Other")
| table _time, host, User, EventCode, FirewallAction, CommandLine, Message
| sort - _time

Cross-platform firewall tampering detection using Sysmon process creation, Windows Firewall event logs (2003-2006, 2033), and Linux syslog. Windows Firewall event IDs provide native detection even without command-line monitoring.

high severity high confidence

Data Sources

Process: Process Creation Firewall: Firewall Rule Modification Windows Firewall Event Log Linux Syslog

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall syslog

False Positives

System administrators legitimately configuring firewall rules for new application deployments
Automated deployment tools (Ansible, Puppet, Chef) that manage firewall rules as part of infrastructure-as-code
Network troubleshooting where firewall is temporarily disabled and re-enabled within a change window
Application installers that add firewall exceptions during setup

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS UserName,
  hostname AS HostName,
  LOGSOURCENAME(logsourceid) AS LogSource,
  CATEGORYNAME(category) AS Category,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  CASE
    WHEN "Command" ILIKE '%set allprofiles state off%' OR "Command" ILIKE '%opmode disable%' OR "Command" ILIKE '%-Enabled False%' OR "Command" ILIKE '%ufw disable%' OR "Command" ILIKE '%pfctl -d%' THEN 'Firewall Disabled'
    WHEN "Command" ILIKE '%firewall add%' OR "Command" ILIKE '%New-NetFirewallRule%' THEN 'Firewall Rule Added'
    WHEN "Command" ILIKE '%firewall delete%' OR "Command" ILIKE '%Remove-NetFirewallRule%' THEN 'Firewall Rule Deleted'
    WHEN "Command" ILIKE '%iptables -F%' OR "Command" ILIKE '%iptables -X%' THEN 'IPTables Flushed'
    WHEN "Command" ILIKE '%iptables -P%ACCEPT%' THEN 'IPTables Policy Set ACCEPT'
    ELSE 'Other Firewall Modification'
  END AS FirewallAction
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 352)
  AND starttime > NOW() - 1 DAYS
  AND (
    "Command" ILIKE '%netsh advfirewall set%'
    OR "Command" ILIKE '%netsh advfirewall firewall add%'
    OR "Command" ILIKE '%netsh advfirewall firewall delete%'
    OR "Command" ILIKE '%netsh firewall set opmode disable%'
    OR "Command" ILIKE '%Set-NetFirewallProfile%Enabled%False%'
    OR "Command" ILIKE '%New-NetFirewallRule%'
    OR "Command" ILIKE '%Remove-NetFirewallRule%'
    OR "Command" ILIKE '%iptables -F%'
    OR "Command" ILIKE '%iptables -X%'
    OR "Command" ILIKE '%iptables -P INPUT ACCEPT%'
    OR "Command" ILIKE '%ufw disable%'
    OR "Command" ILIKE '%pfctl -d%'
    OR "Command" ILIKE '%esxcli network firewall set%'
  )
ORDER BY starttime DESC
LIMIT 1000

Detects firewall disablement or modification events by querying QRadar process execution logs for command-line patterns associated with netsh, PowerShell firewall cmdlets, iptables, ufw, pfctl, and esxcli. Categorizes the action type for analyst triage.

high severity medium confidence

Data Sources

QRadar Windows Sysmon DSM QRadar Linux OS DSM QRadar Microsoft Windows Security Event Log DSM

Required Tables

events

False Positives

IT operations teams executing firewall reconfiguration scripts during planned maintenance windows documented in change management systems.
Penetration testing or red team exercises conducted with written authorization against internal network segments.
Cloud or container orchestration platforms dynamically adjusting host firewall rules during scaling or deployment operations.

Sumo Logic CSE

sql

(_sourceCategory="windows/sysmon" OR _sourceCategory="linux/syslog" OR _sourceCategory="windows/security")
| where (%"EventCode" = "1" OR %"event_id" = "1" OR %"EventCode" = "4688" OR %"sourcetype" = "linux_secure")
| where CommandLine matches /(?i)(netsh advfirewall set|netsh advfirewall firewall add|netsh advfirewall firewall delete|netsh firewall set opmode disable|Set-NetFirewallProfile.*Enabled.*False|New-NetFirewallRule|Remove-NetFirewallRule|iptables -F|iptables -X|iptables -P INPUT ACCEPT|iptables -P FORWARD ACCEPT|ufw disable|pfctl -d|esxcli network firewall set)/
| if(CommandLine matches /(?i)(state off|opmode disable|Enabled.*False|ufw disable|pfctl -d)/, "Firewall Disabled",
   if(CommandLine matches /(?i)(firewall add|New-NetFirewallRule)/, "Rule Added",
   if(CommandLine matches /(?i)(firewall delete|Remove-NetFirewallRule)/, "Rule Deleted",
   if(CommandLine matches /(?i)iptables -[FX]/, "IPTables Flushed",
   if(CommandLine matches /(?i)iptables -P.*ACCEPT/, "IPTables Policy ACCEPT",
   "Other Modification"))))) as FirewallAction
| fields _messageTime, host, User, CommandLine, FirewallAction, ParentImage
| sort by _messageTime desc

Detects system firewall disablement or modification across Windows and Linux platforms by monitoring process command-line arguments for known firewall management tools and cmdlets. Classifies the detected action type for priority-based analyst triage.

high severity high confidence

Data Sources

Sumo Logic Installed Collector (Windows) Sumo Logic Installed Collector (Linux) Sumo Logic Cloud Syslog

Required Tables

windows/sysmon linux/syslog windows/security

False Positives

Authorized firewall policy deployments by network operations teams during scheduled change windows with proper change management tickets.
DevOps CI/CD pipelines automatically configuring firewall rules on newly provisioned virtual machines or containers during infrastructure-as-code workflows.
Endpoint security products or host-based intrusion prevention systems modifying firewall rules as part of their own protection mechanisms.

Google Chronicle / SecOps

yaral

rule disable_or_modify_system_firewall {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects attempts to disable or modify system firewalls via netsh, iptables, ufw, pfctl, PowerShell cmdlets, or esxcli on Windows, Linux, or ESXi hosts."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1562.004"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-20"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.command_line, `(?i)netsh\s+advfirewall\s+set`) or
      re.regex($e.target.process.command_line, `(?i)netsh\s+advfirewall\s+firewall\s+(add|delete)`) or
      re.regex($e.target.process.command_line, `(?i)netsh\s+firewall\s+set\s+opmode\s+disable`) or
      re.regex($e.target.process.command_line, `(?i)Set-NetFirewallProfile.{0,50}-Enabled\s+False`) or
      re.regex($e.target.process.command_line, `(?i)(New|Remove)-NetFirewallRule`) or
      re.regex($e.target.process.command_line, `(?i)iptables\s+(-F|-X|-P\s+INPUT\s+ACCEPT|-P\s+FORWARD\s+ACCEPT)`) or
      re.regex($e.target.process.command_line, `(?i)ufw\s+disable`) or
      re.regex($e.target.process.command_line, `(?i)pfctl\s+-d`) or
      re.regex($e.target.process.command_line, `(?i)esxcli\s+network\s+firewall\s+set`)
    )

  match:
    $e.principal.hostname over 5m

  outcome:
    $firewall_action = if(
      re.regex($e.target.process.command_line, `(?i)(state off|opmode disable|Enabled.*False|ufw disable|pfctl -d)`), "Firewall Disabled",
      re.regex($e.target.process.command_line, `(?i)(firewall add|New-NetFirewallRule)`), "Rule Added",
      re.regex($e.target.process.command_line, `(?i)(firewall delete|Remove-NetFirewallRule)`), "Rule Deleted",
      re.regex($e.target.process.command_line, `(?i)iptables -[FX]`), "IPTables Flushed",
      re.regex($e.target.process.command_line, `(?i)iptables -P.*ACCEPT`), "IPTables Policy ACCEPT",
      "Other Modification"
    )
    $hostname = $e.principal.hostname
    $username = $e.principal.user.userid
    $process_name = $e.target.process.file.full_path
    $command_line = $e.target.process.command_line

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting firewall disablement or modification via process launches containing firewall management command patterns across Windows (netsh, PowerShell) and Linux/BSD (iptables, ufw, pfctl) and VMware ESXi (esxcli). Outputs categorized firewall action type for triage.

high severity high confidence

Data Sources

Google Chronicle UDM Windows Sysmon via Chronicle forwarder Linux Auditd via Chronicle forwarder CrowdStrike Falcon via Chronicle integration

Required Tables

UDM Events (PROCESS_LAUNCH)

False Positives

Legitimate use of configuration management automation (Ansible, Terraform) deploying firewall rule changes during infrastructure provisioning recorded in change management systems.
System administrators executing documented firewall policy updates during approved maintenance windows, particularly on hardened build pipelines.
Security operations center analysts intentionally disabling firewall rules on isolated sandbox machines for malware analysis or threat emulation exercises.

Sigma rule & cross-platform mapping

The detection logic for Disable or Modify System Firewall (T1686) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1686 Sigma rules on detection.fyi

Platform-specific guides for T1686

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-20 Research depth: deep

References (3)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1 Disable Windows Firewall All Profiles

Expected signal: Sysmon Event ID 1: netsh.exe process creation. Windows Firewall Event ID 2003: Firewall profile changed. Each profile state change generates a separate event.
Test 2 Add Firewall Rule for RDP on Non-Standard Port

Expected signal: Sysmon Event ID 1: netsh.exe with 'firewall add rule'. Windows Firewall Event ID 2004: A rule has been added.
Test 3 Flush IPTables Rules on Linux

Expected signal: Auditd execve syscall records for iptables. Syslog entries for iptables commands. MDE DeviceProcessEvents if MDE for Linux is deployed.

Response Playbook

Triage

Determine what exactly changed — was the entire firewall disabled, or was a specific rule added/deleted/modified?
If a rule was added: examine the port, protocol, and direction — does it align with a known service or is it unusual (e.g., opening RDP on a non-standard port)?
Check the user context and whether this change has a corresponding change ticket
Look for temporal correlation with other suspicious activity — was the firewall change preceded by initial access or followed by lateral movement?
On Linux: check if iptables was flushed entirely (iptables -F) — this removes all rules including defensive ones

Containment

Re-enable the firewall immediately if it was disabled entirely: netsh advfirewall set allprofiles state on
Remove unauthorized firewall rules: netsh advfirewall firewall delete rule name="<malicious_rule>"
On Linux: restore iptables rules from backup: iptables-restore < /etc/iptables.rules.backup
Block any newly exposed ports at the network perimeter firewall
If C2 traffic was enabled: identify and block the destination IPs/domains at proxy and DNS level

Evidence Collection

Windows Firewall Event IDs: 2003 (profile changed), 2004 (rule added), 2005 (rule modified), 2006 (rule deleted)
Sysmon Event ID 1: Process creation for netsh.exe, powershell.exe with firewall commands
Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy — firewall policy configuration
Linux: /etc/iptables/rules.v4 or /etc/sysconfig/iptables — saved firewall rules
Linux: iptables -L -n -v output to capture current rule state

Escalation Criteria

! Entire firewall disabled on a production server or domain controller
! Firewall rule added allowing inbound connections on RDP (3389) or SSH (22) from any source
! IPTables flushed on a Linux server exposed to the internet
! Firewall modification followed by detection of external C2 connections or lateral movement
! Multiple hosts showing simultaneous firewall changes (automated malware behavior)

Investigation Guide

Forensic Artifacts

> Windows Firewall Event Log: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
> Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall
> Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall
> Linux: /etc/iptables/rules.v4, /etc/sysconfig/iptables — persistent rules
> Linux: /var/log/ufw.log — UFW firewall log
> Prefetch: NETSH.EXE-*.pf — netsh execution timestamps

Tuning Guidance

Build allowlists for known firewall management processes and accounts. Infrastructure-as-code tools (Ansible, Puppet) typically run under specific service accounts. Application installers that add firewall rules should be baselined. Focus high-severity alerts on complete firewall disablement and rule additions that open broad access. Consider separate alerts for inbound vs outbound rule changes.

Hunting Queries

Hunt for netsh firewall modifications across the environment. Baseline legitimate firewall management and investigate anomalies.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has "advfirewall"
| summarize Count=count(), Actions=make_set(ProcessCommandLine) by DeviceName, AccountName
| sort by Count desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\netsh.exe" CommandLine="*advfirewall*"
| stats count, values(CommandLine) as Actions by host, User
| sort - count

Atomic Red Team Tests

Test 1 Disable Windows Firewall All Profiles

windows

Disables Windows Firewall for all profiles (Domain, Private, Public) using netsh. This is commonly done by ransomware and malware to enable lateral movement.

Command

powershell

netsh advfirewall set allprofiles state off

Cleanup

powershell

netsh advfirewall set allprofiles state on

Expected Telemetry

Sysmon Event ID 1: netsh.exe process creation. Windows Firewall Event ID 2003: Firewall profile changed. Each profile state change generates a separate event.

Expected Detection

KQL: FirewallAction='Firewall Disabled'. SPL: FirewallAction='Firewall Disabled' or EventCode=2003.

Test 2 Add Firewall Rule for RDP on Non-Standard Port

windows

Adds a Windows Firewall rule allowing inbound TCP on port 4444. This simulates adversaries opening ports for RDP or C2 on non-standard ports. Used by Conti group.

Command

powershell

netsh advfirewall firewall add rule name="df00tech-test" dir=in action=allow protocol=TCP localport=4444

Cleanup

powershell

netsh advfirewall firewall delete rule name="df00tech-test"

Expected Telemetry

Sysmon Event ID 1: netsh.exe with 'firewall add rule'. Windows Firewall Event ID 2004: A rule has been added.

Expected Detection

KQL: FirewallAction='Rule Added'. SPL: FirewallAction='Rule Added' or EventCode=2004.

Test 3 Flush IPTables Rules on Linux

linux

Flushes all iptables rules and sets default policies to ACCEPT, effectively disabling the Linux firewall. This removes all defensive network filtering.

Command

bash

iptables -F && iptables -X && iptables -P INPUT ACCEPT && iptables -P FORWARD ACCEPT && iptables -P OUTPUT ACCEPT

Cleanup

bash

iptables-restore < /etc/iptables/rules.v4

Expected Telemetry

Auditd execve syscall records for iptables. Syslog entries for iptables commands. MDE DeviceProcessEvents if MDE for Linux is deployed.

Expected Detection

KQL: FirewallAction='IPTables Flushed'. SPL: FirewallAction='IPTables Flushed' or 'IPTables Accept All'.

Related Detections

Tactic Hub

TA0112 Defense Impairment ATT&CK Matrix

Sub-techniques (3)

Related Techniques

T1562 Impair Defenses T1021.001 Remote Desktop Protocol T1571 Non-Standard Port T1112 Modify Registry

What is T1686 Disable or Modify System Firewall?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1686

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Sub-techniques (3)

Related Techniques

Same Tactic: Defense Impairment

Popular Detections

Get new detections in your inbox