mitre att&ck technique
Disable or Modify System Firewall
View T1562.004 on attack.mitre.org ↗
1 post cover this technique
A memory-acquisition alert led back 17 hours to a KongTuke-style delivery chain, a portable Node.js RAT with Ethereum-based C2 resolution, WinRM enablement, and an attempted upload of a memory image to cloud storage.