Analytics BIOC Low
✕

Suspicious disablement of the Windows Firewall

The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)
Attacker's goals:

An attacker may turn the firewall off to exfiltrate data and communicate with C2 servers.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if the process is legitimately disabling the firewall.

Test period:
N/A (single event)
Deduplication:
7 Days