AN0406
Analytic 0406
Windows
Detection of firewall tampering by monitoring processes executing netsh, PowerShell Set-NetFirewallProfile, or sc stop mpssvc. Registry modifications under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy also indicate adversarial actions.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=13, 14
[MonitoredCommands]
List of admin tools and scripts allowed to legitimately modify firewall settings.
[AlertThreshold]
Number of firewall rule changes within a time window before triggering alert.
AN0407
Analytic 0407
Linux
Detection of iptables, nftables, or firewalld rule modifications. Correlation of sudden drops in active firewall rules with suspicious processes suggests adversarial evasion.
auditd:SYSCALL
execve: iptables, nft, firewall-cmd modifications
linux:osquery
execution of known firewall binaries
[AllowedScripts]
Baseline admin scripts allowed to make firewall modifications.
AN0408
Analytic 0408
macOS
Detection of PF firewall rule modifications via pfctl, socketfilterfw, or defaults write to com.apple.alf. Adversaries often disable firewall profiles entirely or whitelist malicious processes.
macos:unifiedlog
pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf
[PFConfigFiles]
Monitor for baseline pf.conf and custom rule file modifications.
AN0409
Analytic 0409
ESXi
Detection of firewall changes using esxcli network firewall set or vSphere API modifications. Sudden disabling of firewall rules across management interfaces is a strong adversarial signal.
esxi:hostd
esxcli network firewall set commands
esxi:hostd
vSphere API calls modifying firewall settings
[APIMethods]
Whitelist of authorized vSphere API methods for firewall configuration.
AN0410
Analytic 0410
Network Devices
Detection of firewall ACL or rule base changes through CLI (e.g., no access-list, permit any any). Monitor configuration commits from unusual users or sessions.
networkdevice:cli
firewall disable commands or suspicious ACL modifications
[AuthorizedAdmins]
List of approved admin accounts allowed to modify firewall ACLs.