T1686.001 — Cloud Firewall

Tactic: Defense Impairment · Platforms: IaaS

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and…

Sub-technique of Disable or Modify System Firewall (T1686).

Sigma detection rules (1)

T1686.001 Disable or Modify System Firewall: Cloud Firewall

title: "T1686.001 Disable or Modify System Firewall: Cloud Firewall"
id: 559c50b4-59ec-44b0-b63e-e7424b253708
description: 'Detection Strategy for Disable or Modify Cloud Firewall. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedIPRanges, PortScope, RoleContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1686/001
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1686.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'AuthorizeSecurityGroupIngress'
    requestParameters.ipPermissions.items.ipRanges.items.cidrIp: '0.0.0.0/0'

  condition: selection

falsepositives:
  - Legitimate public-facing web tier security groups intentionally opened on ports 80 and 443 for internet traffic.

level: high

Related sub-techniques

Explore