Windows Firewall Profile Disabled

 1title: Windows Firewall Profile Disabled
 2id: 488b44e7-3781-4a71-888d-c95abfacf44d
 3related:
 4    - id: 12f6b752-042d-483e-bf9c-915a6d06ad75
 5      type: similar
 6status: test
 7description: Detects when a user disables the Windows Firewall via a Profile to help evade defense.
 8references:
 9    - https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps
10    - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
11    - http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
12    - http://woshub.com/manage-windows-firewall-powershell/
13    - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html
14author: Austin Songer @austinsonger
15date: 2021/10/12
16modified: 2022/12/30
17tags:
18    - attack.defense_evasion
19    - attack.t1562.004
20logsource:
21    product: windows
22    category: ps_script
23    definition: 'Requirements: Script Block Logging must be enabled'
24detection:
25    selection_args:
26        ScriptBlockText|contains|all:
27            - 'Set-NetFirewallProfile '
28            - ' -Enabled '
29            - ' False'
30    selection_opt:
31        ScriptBlockText|contains:
32            - ' -All '
33            - 'Public'
34            - 'Domain'
35            - 'Private'
36    condition: all of selection*
37falsepositives:
38    - Unknown
39level: medium

References

• Set-NetFirewallProfile (NetSecurity)

  

  Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

  
  Read More

• How to get windows firewall profile settings using PowerShell?

  

  How to get windows firewall profile settings using PowerShell - Recent windows client and server operating systems like Windows 10, Windows Server 2008 onwards, supports advanced firewall versions and they have mainly 3 profiles.DomainPublicPrivate profile.To get the setting using GUI, you need to search in the box Windows Firewall with Advanced Security or Wind

  
  Read More

• Set-NetFirewallRule PowerShell Get-Help Output

  This is the built-in help made by Microsoft for the command 'Set-NetFirewallRule', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell...

  
  Read More

• Managing Windows Firewall Rules with PowerShell | Windows OS Hub

  

  This article covers the basics of managing the settings and rules of the built-in Windows Defender Firewall with Advanced Security from the PowerShell command line. We’ll look at how to…

  
  Read More

• Windows Firewall Disabled via PowerShell | Elastic Security Solution [8.13] | Elastic

  

  Windows Firewall Disabled via PowerShelledit Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network...

  
  Read More

Related rules

• Azure Firewall Modified or Deleted
• Azure Firewall Rule Collection Modified or Deleted
• Bpfdoor TCP Ports Redirect
• Disabling Security Tools - Builtin
• Disable Windows Firewall by Registry