T1686.003 Windows Host Firewall

Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through…

MITRE ATT&CK page ↗

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.