attack.t1686.001

Azure Firewall Modified or Deleted

Apr 28, 2026 · attack.impact attack.defense-impairment attack.t1686.001 ·

Share on:

Identifies when a firewall is created, modified, or deleted.

Azure Firewall Rule Collection Modified or Deleted

Apr 28, 2026 · attack.impact attack.defense-impairment attack.t1686.001 ·

Share on:

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Azure Network Firewall Policy Modified or Deleted

Apr 28, 2026 · attack.impact attack.defense-impairment attack.t1686.001 ·

Share on:

Identifies when a Firewall Policy is Modified or Deleted.

New Network ACL Entry Added

Apr 28, 2026 · attack.defense-impairment attack.t1686.001 ·

Share on:

Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

New Network Route Added

Apr 28, 2026 · attack.defense-impairment attack.t1686.001 ·

Share on:

Detects the addition of a new network route to a route table in AWS.