value:  Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level. ;; H1N1 kills and disables services for Windows Firewall. ;; HARDRAIN opens the Windows Firewall to modify incoming connections. ;; HOPLIGHT has modified the firewall using netsh. ;; InvisiMole has a command to disable routing and the Firewall on the victim’s machine. ;; Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded. ;; Kimsuky has been observed disabling the system firewall. ;; Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. ;; NanoCore can modify the victim's firewall. ;; netsh can be used to disable local firewall settings. ;; njRAT has modified the Windows firewall to allow itself to communicate through the firewall. ;; Operation Wocao has used PowerShell to add and delete rules in the Windows firewall. ;; Remsec can add or remove applications or ports on the Windows firewall or disable it entirely. ;; Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers. ;; TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections. ;; UNC2452 used netsh to configure firewall rules that limited certain UDP outbound packets. ;; ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile. "
name: Impair Defenses: Disable Or Modify System Firewall