Skip to content
T1686 Splunk · SPL

Detect Disable or Modify System Firewall in Splunk

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done via command-line tools (netsh, iptables, ufw, pfctl), editing Windows Registry keys, or through the Windows Control Panel. On ESXi, firewall rules may be modified via esxcli. Adversaries may add new firewall rules for RDP on non-standard ports or open all traffic to enable C2, lateral movement, and data exfiltration.

MITRE ATT&CK

Tactic
Defense Impairment
Technique
T1686 Disable or Modify System Firewall
Canonical reference
https://attack.mitre.org/techniques/T1686/

SPL Detection Query

Splunk (SPL)
spl 
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (CommandLine="*netsh advfirewall set*state off*" OR CommandLine="*netsh advfirewall firewall add*" OR CommandLine="*netsh advfirewall firewall delete*" OR CommandLine="*netsh firewall set opmode disable*" OR CommandLine="*Set-NetFirewallProfile*Enabled*False*" OR CommandLine="*New-NetFirewallRule*" OR CommandLine="*Remove-NetFirewallRule*"))
OR
(index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" EventCode IN (2003, 2004, 2005, 2006, 2033))
OR
(index=linux sourcetype=syslog ("iptables -F" OR "iptables -X" OR "iptables -P INPUT ACCEPT" OR "ufw disable" OR "pfctl -d"))
| eval FirewallAction=case(
    EventCode==2003, "Firewall Profile Changed",
    EventCode==2004, "Firewall Rule Added",
    EventCode==2005, "Firewall Rule Modified",
    EventCode==2006, "Firewall Rule Deleted",
    EventCode==2033, "Firewall Rule Modified (2033)",
    match(_raw, "(?i)(state off|opmode disable|Enabled.*False|ufw disable|pfctl -d)"), "Firewall Disabled",
    match(_raw, "(?i)(iptables -F|iptables -X)"), "IPTables Flushed",
    match(_raw, "(?i)iptables -P.*ACCEPT"), "IPTables Accept All",
    match(_raw, "(?i)(firewall add|New-NetFirewallRule)"), "Rule Added",
    true(), "Other")
| table _time, host, User, EventCode, FirewallAction, CommandLine, Message
| sort - _time
high severity high confidence

Cross-platform firewall tampering detection using Sysmon process creation, Windows Firewall event logs (2003-2006, 2033), and Linux syslog. Windows Firewall event IDs provide native detection even without command-line monitoring.

Data Sources

Process: Process CreationFirewall: Firewall Rule ModificationWindows Firewall Event LogLinux Syslog

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewallsyslog

False Positives & Tuning

  • System administrators legitimately configuring firewall rules for new application deployments
  • Automated deployment tools (Ansible, Puppet, Chef) that manage firewall rules as part of infrastructure-as-code
  • Network troubleshooting where firewall is temporarily disabled and re-enabled within a change window
  • Application installers that add firewall exceptions during setup

Other platforms for T1686

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Disable Windows Firewall All Profiles

    Expected signal: Sysmon Event ID 1: netsh.exe process creation. Windows Firewall Event ID 2003: Firewall profile changed. Each profile state change generates a separate event.

  2. Test 2 Add Firewall Rule for RDP on Non-Standard Port

    Expected signal: Sysmon Event ID 1: netsh.exe with 'firewall add rule'. Windows Firewall Event ID 2004: A rule has been added.

  3. Test 3 Flush IPTables Rules on Linux

    Expected signal: Auditd execve syscall records for iptables. Syslog entries for iptables commands. MDE DeviceProcessEvents if MDE for Linux is deployed.

Last updated: 2026-04-20 Research depth: deep
References (3)

Response Playbook

Triage

  1. Determine what exactly changed — was the entire firewall disabled, or was a specific rule added/deleted/modified?
  2. If a rule was added: examine the port, protocol, and direction — does it align with a known service or is it unusual (e.g., opening RDP on a non-standard port)?
  3. Check the user context and whether this change has a corresponding change ticket
  4. Look for temporal correlation with other suspicious activity — was the firewall change preceded by initial access or followed by lateral movement?
  5. On Linux: check if iptables was flushed entirely (iptables -F) — this removes all rules including defensive ones

Containment

  1. Re-enable the firewall immediately if it was disabled entirely: netsh advfirewall set allprofiles state on
  2. Remove unauthorized firewall rules: netsh advfirewall firewall delete rule name="<malicious_rule>"
  3. On Linux: restore iptables rules from backup: iptables-restore < /etc/iptables.rules.backup
  4. Block any newly exposed ports at the network perimeter firewall
  5. If C2 traffic was enabled: identify and block the destination IPs/domains at proxy and DNS level

Evidence Collection

  1. Windows Firewall Event IDs: 2003 (profile changed), 2004 (rule added), 2005 (rule modified), 2006 (rule deleted)
  2. Sysmon Event ID 1: Process creation for netsh.exe, powershell.exe with firewall commands
  3. Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy — firewall policy configuration
  4. Linux: /etc/iptables/rules.v4 or /etc/sysconfig/iptables — saved firewall rules
  5. Linux: iptables -L -n -v output to capture current rule state

Escalation Criteria

  • !Entire firewall disabled on a production server or domain controller
  • !Firewall rule added allowing inbound connections on RDP (3389) or SSH (22) from any source
  • !IPTables flushed on a Linux server exposed to the internet
  • !Firewall modification followed by detection of external C2 connections or lateral movement
  • !Multiple hosts showing simultaneous firewall changes (automated malware behavior)

Investigation Guide

Forensic Artifacts

  • >Windows Firewall Event Log: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall
  • >Linux: /etc/iptables/rules.v4, /etc/sysconfig/iptables — persistent rules
  • >Linux: /var/log/ufw.log — UFW firewall log
  • >Prefetch: NETSH.EXE-*.pf — netsh execution timestamps

Tuning Guidance

Build allowlists for known firewall management processes and accounts. Infrastructure-as-code tools (Ansible, Puppet) typically run under specific service accounts. Application installers that add firewall rules should be baselined. Focus high-severity alerts on complete firewall disablement and rule additions that open broad access. Consider separate alerts for inbound vs outbound rule changes.

Hunting Queries

Hunt for netsh firewall modifications across the environment. Baseline legitimate firewall management and investigate anomalies.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has "advfirewall"
| summarize Count=count(), Actions=make_set(ProcessCommandLine) by DeviceName, AccountName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\netsh.exe" CommandLine="*advfirewall*"
| stats count, values(CommandLine) as Actions by host, User
| sort - count

Atomic Red Team Tests

Test 1 Disable Windows Firewall All Profiles
windows

Disables Windows Firewall for all profiles (Domain, Private, Public) using netsh. This is commonly done by ransomware and malware to enable lateral movement.

Command

powershell 
netsh advfirewall set allprofiles state off

Cleanup

powershell 
netsh advfirewall set allprofiles state on

Expected Telemetry

Sysmon Event ID 1: netsh.exe process creation. Windows Firewall Event ID 2003: Firewall profile changed. Each profile state change generates a separate event.

Expected Detection

KQL: FirewallAction='Firewall Disabled'. SPL: FirewallAction='Firewall Disabled' or EventCode=2003.

Test 2 Add Firewall Rule for RDP on Non-Standard Port
windows

Adds a Windows Firewall rule allowing inbound TCP on port 4444. This simulates adversaries opening ports for RDP or C2 on non-standard ports. Used by Conti group.

Command

powershell 
netsh advfirewall firewall add rule name="df00tech-test" dir=in action=allow protocol=TCP localport=4444

Cleanup

powershell 
netsh advfirewall firewall delete rule name="df00tech-test"

Expected Telemetry

Sysmon Event ID 1: netsh.exe with 'firewall add rule'. Windows Firewall Event ID 2004: A rule has been added.

Expected Detection

KQL: FirewallAction='Rule Added'. SPL: FirewallAction='Rule Added' or EventCode=2004.

Test 3 Flush IPTables Rules on Linux
linux

Flushes all iptables rules and sets default policies to ACCEPT, effectively disabling the Linux firewall. This removes all defensive network filtering.

Command

bash 
iptables -F && iptables -X && iptables -P INPUT ACCEPT && iptables -P FORWARD ACCEPT && iptables -P OUTPUT ACCEPT

Cleanup

bash 
iptables-restore < /etc/iptables/rules.v4

Expected Telemetry

Auditd execve syscall records for iptables. Syslog entries for iptables commands. MDE DeviceProcessEvents if MDE for Linux is deployed.

Expected Detection

KQL: FirewallAction='IPTables Flushed'. SPL: FirewallAction='IPTables Flushed' or 'IPTables Accept All'.

Related Detections

Tactic Hub

TA0112 Defense Impairment ATT&CK Matrix

Sub-techniques (3)

Related Techniques

T1562 Impair Defenses T1021.001 Remote Desktop Protocol T1571 Non-Standard Port T1112 Modify Registry

Same Tactic: Defense Impairment

Popular Detections