Skip to content
T1686 IBM QRadar · QRadar

Detect Disable or Modify System Firewall in IBM QRadar

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done via command-line tools (netsh, iptables, ufw, pfctl), editing Windows Registry keys, or through the Windows Control Panel. On ESXi, firewall rules may be modified via esxcli. Adversaries may add new firewall rules for RDP on non-standard ports or open all traffic to enable C2, lateral movement, and data exfiltration.

MITRE ATT&CK

Tactic
Defense Impairment
Technique
T1686 Disable or Modify System Firewall
Canonical reference
https://attack.mitre.org/techniques/T1686/

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS UserName,
  hostname AS HostName,
  LOGSOURCENAME(logsourceid) AS LogSource,
  CATEGORYNAME(category) AS Category,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  CASE
    WHEN "Command" ILIKE '%set allprofiles state off%' OR "Command" ILIKE '%opmode disable%' OR "Command" ILIKE '%-Enabled False%' OR "Command" ILIKE '%ufw disable%' OR "Command" ILIKE '%pfctl -d%' THEN 'Firewall Disabled'
    WHEN "Command" ILIKE '%firewall add%' OR "Command" ILIKE '%New-NetFirewallRule%' THEN 'Firewall Rule Added'
    WHEN "Command" ILIKE '%firewall delete%' OR "Command" ILIKE '%Remove-NetFirewallRule%' THEN 'Firewall Rule Deleted'
    WHEN "Command" ILIKE '%iptables -F%' OR "Command" ILIKE '%iptables -X%' THEN 'IPTables Flushed'
    WHEN "Command" ILIKE '%iptables -P%ACCEPT%' THEN 'IPTables Policy Set ACCEPT'
    ELSE 'Other Firewall Modification'
  END AS FirewallAction
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 352)
  AND starttime > NOW() - 1 DAYS
  AND (
    "Command" ILIKE '%netsh advfirewall set%'
    OR "Command" ILIKE '%netsh advfirewall firewall add%'
    OR "Command" ILIKE '%netsh advfirewall firewall delete%'
    OR "Command" ILIKE '%netsh firewall set opmode disable%'
    OR "Command" ILIKE '%Set-NetFirewallProfile%Enabled%False%'
    OR "Command" ILIKE '%New-NetFirewallRule%'
    OR "Command" ILIKE '%Remove-NetFirewallRule%'
    OR "Command" ILIKE '%iptables -F%'
    OR "Command" ILIKE '%iptables -X%'
    OR "Command" ILIKE '%iptables -P INPUT ACCEPT%'
    OR "Command" ILIKE '%ufw disable%'
    OR "Command" ILIKE '%pfctl -d%'
    OR "Command" ILIKE '%esxcli network firewall set%'
  )
ORDER BY starttime DESC
LIMIT 1000
high severity medium confidence

Detects firewall disablement or modification events by querying QRadar process execution logs for command-line patterns associated with netsh, PowerShell firewall cmdlets, iptables, ufw, pfctl, and esxcli. Categorizes the action type for analyst triage.

Data Sources

QRadar Windows Sysmon DSMQRadar Linux OS DSMQRadar Microsoft Windows Security Event Log DSM

Required Tables

events

False Positives & Tuning

  • IT operations teams executing firewall reconfiguration scripts during planned maintenance windows documented in change management systems.
  • Penetration testing or red team exercises conducted with written authorization against internal network segments.
  • Cloud or container orchestration platforms dynamically adjusting host firewall rules during scaling or deployment operations.

Other platforms for T1686

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Disable Windows Firewall All Profiles

    Expected signal: Sysmon Event ID 1: netsh.exe process creation. Windows Firewall Event ID 2003: Firewall profile changed. Each profile state change generates a separate event.

  2. Test 2 Add Firewall Rule for RDP on Non-Standard Port

    Expected signal: Sysmon Event ID 1: netsh.exe with 'firewall add rule'. Windows Firewall Event ID 2004: A rule has been added.

  3. Test 3 Flush IPTables Rules on Linux

    Expected signal: Auditd execve syscall records for iptables. Syslog entries for iptables commands. MDE DeviceProcessEvents if MDE for Linux is deployed.

Last updated: 2026-04-20 Research depth: deep
References (3)

Response Playbook

Triage

  1. Determine what exactly changed — was the entire firewall disabled, or was a specific rule added/deleted/modified?
  2. If a rule was added: examine the port, protocol, and direction — does it align with a known service or is it unusual (e.g., opening RDP on a non-standard port)?
  3. Check the user context and whether this change has a corresponding change ticket
  4. Look for temporal correlation with other suspicious activity — was the firewall change preceded by initial access or followed by lateral movement?
  5. On Linux: check if iptables was flushed entirely (iptables -F) — this removes all rules including defensive ones

Containment

  1. Re-enable the firewall immediately if it was disabled entirely: netsh advfirewall set allprofiles state on
  2. Remove unauthorized firewall rules: netsh advfirewall firewall delete rule name="<malicious_rule>"
  3. On Linux: restore iptables rules from backup: iptables-restore < /etc/iptables.rules.backup
  4. Block any newly exposed ports at the network perimeter firewall
  5. If C2 traffic was enabled: identify and block the destination IPs/domains at proxy and DNS level

Evidence Collection

  1. Windows Firewall Event IDs: 2003 (profile changed), 2004 (rule added), 2005 (rule modified), 2006 (rule deleted)
  2. Sysmon Event ID 1: Process creation for netsh.exe, powershell.exe with firewall commands
  3. Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy — firewall policy configuration
  4. Linux: /etc/iptables/rules.v4 or /etc/sysconfig/iptables — saved firewall rules
  5. Linux: iptables -L -n -v output to capture current rule state

Escalation Criteria

  • !Entire firewall disabled on a production server or domain controller
  • !Firewall rule added allowing inbound connections on RDP (3389) or SSH (22) from any source
  • !IPTables flushed on a Linux server exposed to the internet
  • !Firewall modification followed by detection of external C2 connections or lateral movement
  • !Multiple hosts showing simultaneous firewall changes (automated malware behavior)

Investigation Guide

Forensic Artifacts

  • >Windows Firewall Event Log: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall
  • >Linux: /etc/iptables/rules.v4, /etc/sysconfig/iptables — persistent rules
  • >Linux: /var/log/ufw.log — UFW firewall log
  • >Prefetch: NETSH.EXE-*.pf — netsh execution timestamps

Tuning Guidance

Build allowlists for known firewall management processes and accounts. Infrastructure-as-code tools (Ansible, Puppet) typically run under specific service accounts. Application installers that add firewall rules should be baselined. Focus high-severity alerts on complete firewall disablement and rule additions that open broad access. Consider separate alerts for inbound vs outbound rule changes.

Hunting Queries

Hunt for netsh firewall modifications across the environment. Baseline legitimate firewall management and investigate anomalies.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has "advfirewall"
| summarize Count=count(), Actions=make_set(ProcessCommandLine) by DeviceName, AccountName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\netsh.exe" CommandLine="*advfirewall*"
| stats count, values(CommandLine) as Actions by host, User
| sort - count

Atomic Red Team Tests

Test 1 Disable Windows Firewall All Profiles
windows

Disables Windows Firewall for all profiles (Domain, Private, Public) using netsh. This is commonly done by ransomware and malware to enable lateral movement.

Command

powershell 
netsh advfirewall set allprofiles state off

Cleanup

powershell 
netsh advfirewall set allprofiles state on

Expected Telemetry

Sysmon Event ID 1: netsh.exe process creation. Windows Firewall Event ID 2003: Firewall profile changed. Each profile state change generates a separate event.

Expected Detection

KQL: FirewallAction='Firewall Disabled'. SPL: FirewallAction='Firewall Disabled' or EventCode=2003.

Test 2 Add Firewall Rule for RDP on Non-Standard Port
windows

Adds a Windows Firewall rule allowing inbound TCP on port 4444. This simulates adversaries opening ports for RDP or C2 on non-standard ports. Used by Conti group.

Command

powershell 
netsh advfirewall firewall add rule name="df00tech-test" dir=in action=allow protocol=TCP localport=4444

Cleanup

powershell 
netsh advfirewall firewall delete rule name="df00tech-test"

Expected Telemetry

Sysmon Event ID 1: netsh.exe with 'firewall add rule'. Windows Firewall Event ID 2004: A rule has been added.

Expected Detection

KQL: FirewallAction='Rule Added'. SPL: FirewallAction='Rule Added' or EventCode=2004.

Test 3 Flush IPTables Rules on Linux
linux

Flushes all iptables rules and sets default policies to ACCEPT, effectively disabling the Linux firewall. This removes all defensive network filtering.

Command

bash 
iptables -F && iptables -X && iptables -P INPUT ACCEPT && iptables -P FORWARD ACCEPT && iptables -P OUTPUT ACCEPT

Cleanup

bash 
iptables-restore < /etc/iptables/rules.v4

Expected Telemetry

Auditd execve syscall records for iptables. Syslog entries for iptables commands. MDE DeviceProcessEvents if MDE for Linux is deployed.

Expected Detection

KQL: FirewallAction='IPTables Flushed'. SPL: FirewallAction='IPTables Flushed' or 'IPTables Accept All'.

Related Detections

Tactic Hub

TA0112 Defense Impairment ATT&CK Matrix

Sub-techniques (3)

Related Techniques

T1562 Impair Defenses T1021.001 Remote Desktop Protocol T1571 Non-Standard Port T1112 Modify Registry

Same Tactic: Defense Impairment

Popular Detections