T1686.001Defense Impairment
Cloud Firewall
Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1686.001Cloud FirewallT1686.0016 general rules
- Azure Firewall Modified or Deletedmediumtest
- Azure Firewall Rule Collection Modified or Deletedmediumtest
- Azure Network Firewall Policy Modified or Deletedmediumtest
- New Network Route Addedmediumtest
- AWS Bucket Block Public Access Weakenedmediumexperimental
- New Network ACL Entry Addedlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Cloud Firewall
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.