Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.1 Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface. By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
- Nearest Neighbor Volexity
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1009 | Moses Staff | Iran |
| grp_g1054 | MirrorFace | — |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0049 | OilRig | Iran |
| grp_g1055 | VOID MANTICORE | — |
| grp_g0059 | Magic Hound | Iran |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.