aol.pm

Disable or Modify System Firewall

Technique · ATTACK:enterprise:T1686

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1686",
  "title": "Disable or Modify System Firewall",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1686",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--eec096b8-c207-43df-b6c1-11523861e452",
  "external_id": "T1686",
  "domain": "enterprise",
  "created": "2026-04-14T22:53:27.275Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "Broadcom ESXi Firewall",
      "url": "https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/add-allowed-ip-addresses-for-an-esxi-host-by-using-the-vmware-host-client.html"
    },
    {
      "source_name": "Trellix Rnasomhouse 2024",
      "url": "https://www.trellix.com/en-au/blogs/research/ransomhouse-am-see/"
    },
    {
      "source_name": "change_rdp_port_conti",
      "url": "https://x.com/TheDFIRReport/status/1498657772254240768"
    }
  ]
}

Explicit source assertions (37)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--015f32b7-d24e-4562-851a-c7b829e2b128

Aqua TeamTNT August 2020

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04d0ffea-293c-4660-9735-87419349132e

ESET InvisiMole June 2018

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07442853-5df4-425b-98cb-be22df646b43

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1223 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f6eec8a-8c53-4d38-bf41-37b92358e158

Mandiant Fortinet Zero Day

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10b52204-b034-4f79-b64c-3a01426221d5

Picus BlackByte 2022 · Symantec BlackByte 2022

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2496b1fe-0a73-4918-82e6-7f2a07c44353

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283bdd31-247b-47aa-886b-66db5ca13eff

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b11b20a-2b25-417f-8826-0fef4336ebfc

CISA Leviathan 2024

ATTACK:enterprise:T1686.003 → subtechnique-of → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c465873-a6a2-456b-b30e-3358f1e90dad

ATTACK:enterprise:S0108 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35edfce6-c395-4dcd-b5be-848860f68d23

TechNet Netsh · TechNet Netsh Firewall

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c17948b-96f6-4f0f-ac37-7393ea5d832b

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d91bd80-37e8-401d-8ff6-79b968cebbad

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dbfc708-e582-4e7e-997f-b8d5843ee28b

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e4fdef4-b0a4-4899-849e-2e16af6a95f3

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ee52edf-aa8a-40e1-a9ab-532724d17224

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:S1032 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--627388f8-3e1a-4146-af0b-5dffacafdfa2

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66bcb598-3414-4e4f-b17e-f835daa7f803

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--715428e2-873b-4345-b61d-8d72390cab01

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:S0088 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b448393-a3d5-4a2e-b96f-591653438eab

Zscaler Kasidet

ATTACK:enterprise:S1211 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b7fbbfe-60e0-44b2-87ea-d3488548f8b3

Symantec Bilbug 2022

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80e9ec9c-ecb4-48c3-944c-e318fec4a656

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83ce1f0c-8afc-472d-af07-71b359d7781b

BlackBerry_FIN7_April2024

ATTACK:enterprise:T1686.001 → subtechnique-of → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85a6e223-603b-4055-bea8-49ca3c9b9eea

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86b724dd-09f8-4182-adff-08ba6e391747

DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--914014ba-ee7d-46da-ab51-609c1f67dec0

US-CERT TA18-074A

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9341533c-bf26-4ca0-9273-7e7f57b5bff6

Securelist Kimsuky Sept 2013

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94380550-1855-4032-8635-9e19e5616903

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a49751ab-abbb-414f-926e-97c7fa3da30c

Talos ZxShell Oct 2014

ATTACK:enterprise:T1686.002 → subtechnique-of → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a60297a2-9f63-4c41-9b4c-51c1236aed95

ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad269937-6339-4686-8f3b-369e0c65afc6

Sandfly BPFDoor 2022

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfb5e752-4fc0-44c8-91a5-58a9d70119f0

Talos Rocke August 2018

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c417a3d9-5a49-426d-be92-3763915fd370

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c45026a7-dbe4-4ea6-946d-abb66a78f4d6

FireEye APT30

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8eec284-ab05-48a5-b79e-412db42f7123

Group-IB Anunak

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cef26a74-8a95-4f9d-8a60-3da9fc452725

Kaspersky ShrinkLocker 2024 · Splunk ShrinkLocker 2024

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1c4e56d-8738-4f8b-ac06-5db3877abac8

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero Day

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0690af9-5784-4f63-983a-a6d8747f9d32

ESET Grandoreiro April 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.