T1686.003: Windows Host Firewall
Essential information
- MITRE technique ID
T1686.003- Confidence
- 75/100
- Revoked
- No
- Published
- 15/04/2026 00:54
- Modified
- 29/05/2026 12:19
- Author / Source
- The MITRE Corporation
Platforms
windows
Description
Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity)
Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.
By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | defense-impairment |
| mitre-attack-v19 | defense-impairment |
Marking (TLP)
Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.