Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less secure port).1 Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.23
- change_rdp_port_conti
- Broadcom ESXi Firewall
- Trellix Rnasomhouse 2024
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1047 | Velvet Ant | — |
| grp_g1043 | BlackByte | — |
| grp_g1045 | Salt Typhoon | — |
| grp_g1051 | Medusa Group | — |
| grp_g1048 | UNC3886 | — |
| grp_g0008 | Carbanak | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g0082 | APT38 | DPRK |
| grp_g0046 | FIN7 | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0139 | TeamTNT | — |
| grp_g0106 | Rocke | — |
| grp_g1022 | ToddyCat | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.