attack.t1686

Bpfdoor TCP Ports Redirect

Apr 28, 2026 · attack.defense-impairment attack.t1686 ·

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Disable System Firewall

Apr 28, 2026 · attack.defense-impairment attack.t1686 ·

Share on:

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Disabling Security Tools

Apr 28, 2026 · attack.defense-impairment attack.t1686 ·

Share on:

Detects disabling security tools

Disabling Security Tools - Builtin

Apr 28, 2026 · attack.defense-impairment attack.t1686 ·

Share on:

Detects disabling security tools

Flush Iptables Ufw Chain

Apr 28, 2026 · attack.defense-impairment attack.t1686 ·

Share on:

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

Modify System Firewall

Apr 28, 2026 · attack.defense-impairment attack.t1686 ·

Share on:

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

Bpfdoor TCP Ports Redirect

Disable System Firewall

Disabling Security Tools

Disabling Security Tools - Builtin

Flush Iptables Ufw Chain

Modify System Firewall

Ufw Force Stop Using Ufw-Init