# T1562.004 - Disable or Modify System Firewall
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1562/004)
<blockquote>Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. </blockquote>

## Atomic Tests

- [Atomic Test #1 - Disable Microsoft Defender Firewall](#atomic-test-1---disable-microsoft-defender-firewall)

- [Atomic Test #2 - Disable Microsoft Defender Firewall via Registry](#atomic-test-2---disable-microsoft-defender-firewall-via-registry)

- [Atomic Test #3 - Allow SMB and RDP on Microsoft Defender Firewall](#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall)

- [Atomic Test #4 - Opening ports for proxy - HARDRAIN](#atomic-test-4---opening-ports-for-proxy---hardrain)

- [Atomic Test #5 - Open a local port through Windows Firewall to any profile](#atomic-test-5---open-a-local-port-through-windows-firewall-to-any-profile)

- [Atomic Test #6 - Allow Executable Through Firewall Located in Non-Standard Location](#atomic-test-6---allow-executable-through-firewall-located-in-non-standard-location)

- [Atomic Test #7 - Stop/Start UFW firewall](#atomic-test-7---stopstart-ufw-firewall)

- [Atomic Test #8 - Stop/Start UFW firewall systemctl](#atomic-test-8---stopstart-ufw-firewall-systemctl)

- [Atomic Test #9 - Turn off UFW logging](#atomic-test-9---turn-off-ufw-logging)

- [Atomic Test #10 - Add and delete UFW firewall rules](#atomic-test-10---add-and-delete-ufw-firewall-rules)

- [Atomic Test #11 - Edit UFW firewall user.rules file](#atomic-test-11---edit-ufw-firewall-userrules-file)

- [Atomic Test #12 - Edit UFW firewall ufw.conf file](#atomic-test-12---edit-ufw-firewall-ufwconf-file)

- [Atomic Test #13 - Edit UFW firewall sysctl.conf file](#atomic-test-13---edit-ufw-firewall-sysctlconf-file)

- [Atomic Test #14 - Edit UFW firewall main configuration file](#atomic-test-14---edit-ufw-firewall-main-configuration-file)

- [Atomic Test #15 - Tail the UFW firewall log file](#atomic-test-15---tail-the-ufw-firewall-log-file)


<br/>

## Atomic Test #1 - Disable Microsoft Defender Firewall
Disables the Microsoft Defender Firewall for the current profile.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...

**Supported Platforms:** Windows


**auto_generated_guid:** 88d05800-a5e4-407e-9b53-ece4174f197f






#### Attack Commands: Run with `command_prompt`! 


```cmd
netsh advfirewall set currentprofile state off
```

#### Cleanup Commands:
```cmd
netsh advfirewall set currentprofile state on >nul 2>&1
```





<br/>
<br/>

## Atomic Test #2 - Disable Microsoft Defender Firewall via Registry
Disables the Microsoft Defender Firewall for the public profile via registry
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...

**Supported Platforms:** Windows


**auto_generated_guid:** afedc8c4-038c-4d82-b3e5-623a95f8a612






#### Attack Commands: Run with `command_prompt`! 


```cmd
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
```

#### Cleanup Commands:
```cmd
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 1 /f
```





<br/>
<br/>

## Atomic Test #3 - Allow SMB and RDP on Microsoft Defender Firewall
Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...

**Supported Platforms:** Windows


**auto_generated_guid:** d9841bf8-f161-4c73-81e9-fd773a5ff8c1






#### Attack Commands: Run with `command_prompt`! 


```cmd
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes
```

#### Cleanup Commands:
```cmd
netsh advfirewall reset >nul 2>&1
```





<br/>
<br/>

## Atomic Test #4 - Opening ports for proxy - HARDRAIN
This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf

**Supported Platforms:** Windows


**auto_generated_guid:** 15e57006-79dd-46df-9bf9-31bc24fb5a80






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
netsh advfirewall firewall add rule name="atomic testing" action=allow dir=in protocol=TCP localport=450
```

#### Cleanup Commands:
```cmd
netsh advfirewall firewall delete rule name="atomic testing" protocol=TCP localport=450 >nul 2>&1
```





<br/>
<br/>

## Atomic Test #5 - Open a local port through Windows Firewall to any profile
This test will attempt to open a local port defined by input arguments to any profile

**Supported Platforms:** Windows


**auto_generated_guid:** 9636dd6e-7599-40d2-8eee-ac16434f35ed





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| local_port | This is the local port you wish to test opening | Integer | 3389|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
netsh advfirewall firewall add rule name="Open Port to Any" dir=in protocol=tcp localport=#{local_port} action=allow profile=any
```

#### Cleanup Commands:
```powershell
netsh advfirewall firewall delete rule name="Open Port to Any" | Out-Null
```





<br/>
<br/>

## Atomic Test #6 - Allow Executable Through Firewall Located in Non-Standard Location
This test will attempt to allow an executable through the system firewall located in the Users directory

**Supported Platforms:** Windows


**auto_generated_guid:** 6f5822d2-d38d-4f48-9bfc-916607ff6b8c





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| exe_file_path | path to exe file | Path | PathToAtomicsFolder&#92;T1562.004&#92;bin&#92;AtomicTest.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Copy-Item #{exe_file_path} -Destination "C:\Users\$env:UserName" -Force
netsh advfirewall firewall add rule name="Atomic Test" dir=in action=allow program="C:\Users\$env:UserName\AtomicTest.exe" enable=yes
```

#### Cleanup Commands:
```powershell
netsh advfirewall firewall delete rule name="Atomic Test" | Out-Null
Remove-Item C:\Users\$env:UserName\AtomicTest.exe -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #7 - Stop/Start UFW firewall
Stop the Uncomplicated Firewall (UFW) if installed.

**Supported Platforms:** Linux


**auto_generated_guid:** fe135572-edcd-49a2-afe6-1d39521c5a9a






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
ufw disable
```

#### Cleanup Commands:
```sh
ufw enable
ufw status verbose
```



#### Dependencies:  Run with `sh`!
##### Description: Check if ufw is installed on the machine.
##### Check Prereq Commands:
```sh
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #8 - Stop/Start UFW firewall systemctl
Stop the Uncomplicated Firewall (UFW) if installed, using systemctl.

**Supported Platforms:** Linux


**auto_generated_guid:** 9fd99609-1854-4f3c-b47b-97d9a5972bd1






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
systemctl stop ufw
```

#### Cleanup Commands:
```sh
systemctl start ufw
systemctl status ufw
```



#### Dependencies:  Run with `sh`!
##### Description: Check if systemctl and ufw is installed on the machine.
##### Check Prereq Commands:
```sh
if [ ! -x "$(command -v systemctl)" ]; then echo -e "\n***** systemctl NOT installed *****\n"; exit 1; fi
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #9 - Turn off UFW logging
Turn off the Uncomplicated Firewall (UFW) logging.

**Supported Platforms:** Linux


**auto_generated_guid:** 8a95b832-2c2a-494d-9cb0-dc9dd97c8bad






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
ufw logging off
```

#### Cleanup Commands:
```sh
ufw logging low
ufw status verbose
```



#### Dependencies:  Run with `sh`!
##### Description: Check if ufw is installed on the machine and enabled.
##### Check Prereq Commands:
```sh
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #10 - Add and delete UFW firewall rules
Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled.

**Supported Platforms:** Linux


**auto_generated_guid:** b2563a4e-c4b8-429c-8d47-d5bcb227ba7a






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
ufw prepend deny from 1.2.3.4
ufw status numbered
```

#### Cleanup Commands:
```sh
{ echo y; echo response; } | ufw delete 1
ufw status numbered
```



#### Dependencies:  Run with `sh`!
##### Description: Check if ufw is installed on the machine and enabled.
##### Check Prereq Commands:
```sh
if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #11 - Edit UFW firewall user.rules file
Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.

**Supported Platforms:** Linux


**auto_generated_guid:** beaf815a-c883-4194-97e9-fdbbb2bbdd7c






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
echo "# THIS IS A COMMENT" >> /etc/ufw/user.rules
grep "# THIS IS A COMMENT" /etc/ufw/user.rules
```

#### Cleanup Commands:
```sh
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/user.rules
```



#### Dependencies:  Run with `sh`!
##### Description: Check if /etc/ufw/user.rules exists.
##### Check Prereq Commands:
```sh
if [ ! -f "/etc/ufw/user.rules" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #12 - Edit UFW firewall ufw.conf file
Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf 
which controls if the firewall starts on boot and its logging level.

**Supported Platforms:** Linux


**auto_generated_guid:** c1d8c4eb-88da-4927-ae97-c7c25893803b






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
echo "# THIS IS A COMMENT" >> /etc/ufw/ufw.conf
grep "# THIS IS A COMMENT" /etc/ufw/ufw.conf
```

#### Cleanup Commands:
```sh
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/ufw.conf
cat /etc/ufw/ufw.conf
```



#### Dependencies:  Run with `sh`!
##### Description: Check if /etc/ufw/ufw.conf exists.
##### Check Prereq Commands:
```sh
if [ ! -f "/etc/ufw/ufw.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #13 - Edit UFW firewall sysctl.conf file
Edit the Uncomplicated Firewall (UFW) configuration file for setting network 
variables /etc/ufw/sysctl.conf.

**Supported Platforms:** Linux


**auto_generated_guid:** c4ae0701-88d3-4cd8-8bce-4801ed9f97e4






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
echo "# THIS IS A COMMENT" >> /etc/ufw/sysctl.conf
grep "# THIS IS A COMMENT" /etc/ufw/sysctl.conf
```

#### Cleanup Commands:
```sh
sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/sysctl.conf
cat /etc/ufw/sysctl.conf
```



#### Dependencies:  Run with `sh`!
##### Description: Check if /etc/ufw/sysctl.conf exists.
##### Check Prereq Commands:
```sh
if [ ! -f "/etc/ufw/sysctl.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #14 - Edit UFW firewall main configuration file
Edit the Uncomplicated Firewall (UFW) main configuration file for setting 
default policies /etc/default/ufw.

**Supported Platforms:** Linux


**auto_generated_guid:** 7b697ece-8270-46b5-bbc7-6b9e27081831






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
echo "# THIS IS A COMMENT" >> /etc/default/ufw
grep "# THIS IS A COMMENT" /etc/default/ufw
```

#### Cleanup Commands:
```sh
sed -i 's/# THIS IS A COMMENT//g' /etc/default/ufw
```



#### Dependencies:  Run with `sh`!
##### Description: Check if /etc/default/ufw exists.
##### Check Prereq Commands:
```sh
if [ ! -f "/etc/default/ufw" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
<br/>

## Atomic Test #15 - Tail the UFW firewall log file
Print  the last 10 lines of the Uncomplicated Firewall (UFW) log file 
/var/log/ufw.log.

**Supported Platforms:** Linux


**auto_generated_guid:** 419cca0c-fa52-4572-b0d7-bc7c6f388a27






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
tail /var/log/ufw.log
```

#### Cleanup Commands:
```sh

```



#### Dependencies:  Run with `sh`!
##### Description: Check if /var/log/ufw.log exists.
##### Check Prereq Commands:
```sh
if [ ! -f "/var/log/ufw.log" ]; then echo -e "\n***** ufw NOT logging *****\n"; exit 1; fi
```
##### Get Prereq Commands:
```sh
echo ""
```




<br/>
