T1686.003 — Windows Host Firewall

T1686.003 Disable or Modify System Firewall: Windows Host Firewall

title: "T1686.003 Disable or Modify System Firewall: Windows Host Firewall"
id: a266887e-5e34-4ae7-9b0c-6b9003ca1cfb
description: 'Detects disabling/modifying the Windows host firewall via netsh advfirewall commands or PowerShell NetFirewall cmdlets. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: AuthorizedAdminAccounts, MaintenanceWindow, ExposureCorrelationWindow, SensitivePorts, AllowedManagementParents, RuleScopeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1686/003
author: Shahrukh Khan
date: 2026-05-22
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1686.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_netsh_disable:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'advfirewall'
      - 'state off'
  selection_netsh_rule:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'advfirewall'
      - 'firewall'
  selection_powershell:
    CommandLine|contains:
      - 'Set-NetFirewallProfile'
      - 'Disable-NetFirewallRule'
      - 'New-NetFirewallRule'
      - 'Remove-NetFirewallRule'
      - 'Set-NetFirewallRule'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_netsh_disable or selection_netsh_rule or selection_powershell) and not filter_system_account

falsepositives:
  - Legitimate firewall administration.

level: medium