attack_technique: T1562.004
display_name: 'Impair Defenses: Disable or Modify System Firewall'
atomic_tests:
- name: Disable Microsoft Defender Firewall
  auto_generated_guid: 88d05800-a5e4-407e-9b53-ece4174f197f
  description: |
    Disables the Microsoft Defender Firewall for the current profile.
    Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
  supported_platforms:
  - windows
  executor:
    command: |
      netsh advfirewall set currentprofile state off
    cleanup_command: |
      netsh advfirewall set currentprofile state on >nul 2>&1
    name: command_prompt
- name: Disable Microsoft Defender Firewall via Registry
  auto_generated_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612
  description: |
    Disables the Microsoft Defender Firewall for the public profile via registry
    Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
  supported_platforms:
  - windows
  executor:
    command: |
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
    cleanup_command: |
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 1 /f
    name: command_prompt
- name: Allow SMB and RDP on Microsoft Defender Firewall
  auto_generated_guid: d9841bf8-f161-4c73-81e9-fd773a5ff8c1
  description: |
    Allow all SMB and RDP rules on the Microsoft Defender Firewall for all profiles.
    Caution if you access remotely the host where the test runs! Especially with the cleanup command which will reset the firewall and risk disabling those services...
  supported_platforms:
  - windows
  executor:
    command: |
      netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
      netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes
    cleanup_command: |
      netsh advfirewall reset >nul 2>&1
    name: command_prompt
- name: Opening ports for proxy - HARDRAIN 
  auto_generated_guid: 15e57006-79dd-46df-9bf9-31bc24fb5a80
  description: |
    This test creates a listening interface on a victim device. This tactic was used by HARDRAIN for proxying.

    reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf
  supported_platforms:
  - windows
  executor:
    command: |
      netsh advfirewall firewall add rule name="atomic testing" action=allow dir=in protocol=TCP localport=450 
    cleanup_command: netsh advfirewall firewall delete rule name="atomic testing" protocol=TCP localport=450 >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Open a local port through Windows Firewall to any profile
  auto_generated_guid: 9636dd6e-7599-40d2-8eee-ac16434f35ed
  description: This test will attempt to open a local port defined by input arguments to any profile
  supported_platforms:
  - windows
  input_arguments:
    local_port:
      description: This is the local port you wish to test opening
      type: Integer
      default: 3389
  executor:
    command: netsh advfirewall firewall add rule name="Open Port to Any" dir=in protocol=tcp localport=#{local_port} action=allow profile=any
    cleanup_command: netsh advfirewall firewall delete rule name="Open Port to Any" | Out-Null
    name: powershell
    elevation_required: true
- name: Allow Executable Through Firewall Located in Non-Standard Location
  auto_generated_guid: 6f5822d2-d38d-4f48-9bfc-916607ff6b8c
  description: This test will attempt to allow an executable through the system firewall located in the Users directory
  supported_platforms:
  - windows
  input_arguments:
    exe_file_path:
      description: path to exe file
      type: Path
      default: PathToAtomicsFolder\T1562.004\bin\AtomicTest.exe
  executor:
    command: |
      Copy-Item #{exe_file_path} -Destination "C:\Users\$env:UserName" -Force
      netsh advfirewall firewall add rule name="Atomic Test" dir=in action=allow program="C:\Users\$env:UserName\AtomicTest.exe" enable=yes
    cleanup_command: |
      netsh advfirewall firewall delete rule name="Atomic Test" | Out-Null
      Remove-Item C:\Users\$env:UserName\AtomicTest.exe -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: Stop/Start UFW firewall 
  auto_generated_guid: fe135572-edcd-49a2-afe6-1d39521c5a9a
  description: |
    Stop the Uncomplicated Firewall (UFW) if installed.
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if ufw is installed on the machine.
      prereq_command: | 
        if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
        if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi 
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      ufw disable
    cleanup_command: |
      ufw enable
      ufw status verbose
- name: Stop/Start UFW firewall systemctl 
  auto_generated_guid: 9fd99609-1854-4f3c-b47b-97d9a5972bd1
  description: |
    Stop the Uncomplicated Firewall (UFW) if installed, using systemctl. 
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if systemctl and ufw is installed on the machine.
      prereq_command: | 
        if [ ! -x "$(command -v systemctl)" ]; then echo -e "\n***** systemctl NOT installed *****\n"; exit 1; fi
        if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
        if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi 
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      systemctl stop ufw
    cleanup_command: |
      systemctl start ufw
      systemctl status ufw
- name: Turn off UFW logging  
  auto_generated_guid: 8a95b832-2c2a-494d-9cb0-dc9dd97c8bad
  description: |
    Turn off the Uncomplicated Firewall (UFW) logging. 
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if ufw is installed on the machine and enabled.
      prereq_command: | 
        if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
        if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi 
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      ufw logging off
    cleanup_command: |
      ufw logging low
      ufw status verbose
- name: Add and delete UFW firewall rules 
  auto_generated_guid: b2563a4e-c4b8-429c-8d47-d5bcb227ba7a
  description: |
    Add and delete a rule on the Uncomplicated Firewall (UFW) if installed and enabled. 
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if ufw is installed on the machine and enabled.
      prereq_command: | 
        if [ ! -x "$(command -v ufw)" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
        if echo "$(ufw status)" |grep -q "inactive"; then echo -e "\n***** ufw inactive *****\n"; exit 1; fi 
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      ufw prepend deny from 1.2.3.4
      ufw status numbered
    cleanup_command: |
      { echo y; echo response; } | ufw delete 1
      ufw status numbered
- name: Edit UFW firewall user.rules file 
  auto_generated_guid: beaf815a-c883-4194-97e9-fdbbb2bbdd7c
  description: |
    Edit the Uncomplicated Firewall (UFW) rules file /etc/ufw/user.rules.
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if /etc/ufw/user.rules exists.
      prereq_command: | 
        if [ ! -f "/etc/ufw/user.rules" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      echo "# THIS IS A COMMENT" >> /etc/ufw/user.rules
      grep "# THIS IS A COMMENT" /etc/ufw/user.rules
    cleanup_command: |
      sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/user.rules
- name: Edit UFW firewall ufw.conf file 
  auto_generated_guid: c1d8c4eb-88da-4927-ae97-c7c25893803b
  description: |
    Edit the Uncomplicated Firewall (UFW) configuration file /etc/ufw/ufw.conf 
    which controls if the firewall starts on boot and its logging level.
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if /etc/ufw/ufw.conf exists.
      prereq_command: | 
        if [ ! -f "/etc/ufw/ufw.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      echo "# THIS IS A COMMENT" >> /etc/ufw/ufw.conf
      grep "# THIS IS A COMMENT" /etc/ufw/ufw.conf
    cleanup_command: |
      sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/ufw.conf
      cat /etc/ufw/ufw.conf
- name: Edit UFW firewall sysctl.conf file 
  auto_generated_guid: c4ae0701-88d3-4cd8-8bce-4801ed9f97e4
  description: |
    Edit the Uncomplicated Firewall (UFW) configuration file for setting network 
    variables /etc/ufw/sysctl.conf.
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if /etc/ufw/sysctl.conf exists.
      prereq_command: | 
        if [ ! -f "/etc/ufw/sysctl.conf" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      echo "# THIS IS A COMMENT" >> /etc/ufw/sysctl.conf
      grep "# THIS IS A COMMENT" /etc/ufw/sysctl.conf
    cleanup_command: |
      sed -i 's/# THIS IS A COMMENT//g' /etc/ufw/sysctl.conf
      cat /etc/ufw/sysctl.conf
- name: Edit UFW firewall main configuration file 
  auto_generated_guid: 7b697ece-8270-46b5-bbc7-6b9e27081831
  description: |
    Edit the Uncomplicated Firewall (UFW) main configuration file for setting 
    default policies /etc/default/ufw.
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if /etc/default/ufw exists.
      prereq_command: | 
        if [ ! -f "/etc/default/ufw" ]; then echo -e "\n***** ufw NOT installed *****\n"; exit 1; fi
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      echo "# THIS IS A COMMENT" >> /etc/default/ufw
      grep "# THIS IS A COMMENT" /etc/default/ufw
    cleanup_command: |
      sed -i 's/# THIS IS A COMMENT//g' /etc/default/ufw
- name: Tail the UFW firewall log file 
  auto_generated_guid: 419cca0c-fa52-4572-b0d7-bc7c6f388a27
  description: |
    Print  the last 10 lines of the Uncomplicated Firewall (UFW) log file 
    /var/log/ufw.log.
  supported_platforms:
  - linux
  dependency_executor_name: sh
  dependencies: 
    - description: |
        Check if /var/log/ufw.log exists.
      prereq_command: | 
        if [ ! -f "/var/log/ufw.log" ]; then echo -e "\n***** ufw NOT logging *****\n"; exit 1; fi
      get_prereq_command: | 
        echo ""
  executor:
    name: sh
    elevation_required: true
    command: |
      tail /var/log/ufw.log
    cleanup_command: |
