Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1562.004_disable-or-modify-system-firewall
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.
Passed 20 of 23 test cases with the skill, and 16 of 23 without it.
and 2 more in the full report
4 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
To mitigate adversaries tampering with host firewalls, security teams should regularly review user role assignments and administrative rights. Which specific MITRE ATT&CK mitigation control ID represents periodic auditing of account role permissions?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies M1047 Audit | Missed | Passed |
| Focuses on auditing account role permissions to restrict firewall modification privileges | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1562
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. Non-Standard Port).
Adversaries may also modify host networking settings that indirectly manipulate system firewalls, such as interface bandwidth or network connection request thresholds. Settings related to enabling abuse of various Remote Services may also indirectly modify firewall rules.
In ESXi, firewall rules may be modified directly via the esxcli command line interface (e.g., via esxcli network firewall set) or via the vCenter user interface.
Platforms: ESXi, Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Disables the Microsoft Defender Firewall for the current profile. Caution if you access remotely the host where the test runs! Especially with the cleanup command which will re-enable firewall for the current profile...
test cases passed, vs 16 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.