Disable or Modify System Firewall T1686
Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic.…
- Tactics
- Defense Impairment
- Actors using it
- 19
- Sub-techniques
- 0
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- Medusa Group52 techniques
- VOID MANTICOREIran · COBALT MYSTIQUE, Handala Hack, Homeland Justice · 51 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- DragonflyRussia · TEMP.Isotope, DYMALLOY, Berserk Bear · 48 techniques
- BlackByteHecamede · 44 techniques
- Salt TyphoonChina · 43 techniques
- TeamTNT43 techniques
- UNC3886China · 37 techniques
- MirrorFaceChina · Earth Kasha · 37 techniques
- RockeChina · 29 techniques
- ToddyCat24 techniques
- Velvet Ant22 techniques
- Moses StaffIran · DEV-0500, Marigold Sandstorm · 12 techniques
- CarbanakAnunak · 8 techniques