ATT&CK technique
View on MITRE ATT&CK →
T1562.004
Disable or Modify System Firewall
Stealth
deprecated
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Linux Firewall Rule Creation or Modification | production | 2026-10-23 |
| elastic | ESXi Firewall Disabled | production | 2026-09-30 |
| elastic | Disable Windows Firewall Rules via Netsh | production | 2026-09-18 |
| elastic | Remote Desktop Enabled in Windows Firewall by Netsh | production | 2026-09-18 |
| elastic | Attempt to Disable IPTables or Firewall | production | 2026-09-18 |
| elastic | Windows Firewall Disabled via PowerShell | production | 2026-09-18 |
| elastic | Potential Evasion via Windows Filtering Platform | production | 2026-09-18 |
| elastic | Enable Host Network Discovery via Netsh | production | 2026-09-18 |
| elastic | FortiGate Overly Permissive Firewall Policy Created | production | 2026-09-18 |