Loading ATT&CK
Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice
Each is its own technique in the catalogue, with its own detections.
Every one carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Windows Modify System Firewall with Notable Process Path | Medium |
| Windows Firewall Rule Modification | Informational |
| Windows Firewall Rule Deletion | Informational |
| Windows Firewall Rule Added | Informational |
| Windows Delete or Modify System Firewall | Medium |
| Linux Stdout Redirection To Dev Null File | Informational |
| Linux Iptables Firewall Modification | Informational |
| Linux Auditd Disable Or Modify System Firewall | Informational |
| Firewall Allowed Program Enable | Informational |
| Microsoft Intune DeviceManagementConfigurationPolicies | Medium |
| ESXi Firewall Disabled | Medium |
| Disabling Security Tools | Medium |
| Flush Iptables Ufw Chain | Medium |
| UFW Disable Attempt | Medium |
| Disabling Security Tools - Builtin | Medium |
| Disable System Firewall | High |
| Modify System Firewall | Medium |
| Bpfdoor TCP Ports Redirect | Medium |
Showing 18 of 18