T1686.002 — Network Device Firewall

Tactic: Defense Impairment · Platforms: Network Devices

Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control…

Sub-technique of Disable or Modify System Firewall (T1686).

Sigma detection rules (1)

T1686.002 Disable or Modify System Firewall: Network Device Firewall

title: "T1686.002 Disable or Modify System Firewall: Network Device Firewall"
id: 6b3433ac-724e-49b8-ada0-f3cbaef9403c
description: 'Detects Linux host-level firewall permissive changes (iptables/nft flush or default-ACCEPT policy) as the closest auditd-observable proxy for T1686.002, which natively concerns disabling firewall protections on dedicated network appliances (routers/switches) - a control plane not covered by Linux auditd. This rule only applies when the monitored Linux host itself functions as a network gateway/firewall (e.g. netfilter-based router); it cannot observe configuration changes on non-Linux network appliance operating systems. Tune using: TrustedAdminIPs, ConfigChangeWindow, RuleScopeThreshold, NewUserPrivilegeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1686/002
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1686.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_iptables_flush:
    type: EXECVE
    a0|endswith:
      - '/iptables'
      - '/ip6tables'
    a1:
      - '-F'
      - '--flush'
  selection_iptables_policy_accept:
    type: EXECVE
    a0|endswith:
      - '/iptables'
      - '/ip6tables'
    a1:
      - '-P'
      - '--policy'
    a3: 'ACCEPT'
  selection_nft_flush:
    type: EXECVE
    a0|endswith: '/nft'
    a1: 'flush'
    a2:
      - 'ruleset'
      - 'table'

  condition: 1 of selection_*

falsepositives:
  - Network administrators and configuration management tools legitimately flush or reset firewall rules/policies during planned maintenance windows; this cannot alone confirm malicious intent.

level: high

Related sub-techniques

Explore