Firewall Disabled via Netsh.EXE

 1title: Firewall Disabled via Netsh.EXE
 2id: 57c4bf16-227f-4394-8ec7-1b745ee061c3
 3status: test
 4description: Detects netsh commands that turns off the Windows firewall
 5references:
 6    - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
 7    - https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
 8    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall
 9author: Fatih Sirin
10date: 2019-11-01
11modified: 2023-02-13
12tags:
13    - attack.defense-evasion
14    - attack.t1562.004
15    - attack.s0108
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection_img:
21        - Image|endswith: '\netsh.exe'
22        - OriginalFileName: 'netsh.exe'
23    selection_cli_1:
24        # Example: netsh firewall set opmode disable
25        CommandLine|contains|all:
26            - 'firewall'
27            - 'set'
28            - 'opmode'
29            - 'disable'
30    selection_cli_2:
31        # Example: netsh advfirewall set currentprofile state off
32        CommandLine|contains|all:
33            - 'advfirewall'
34            - 'set'
35            - 'state'
36            - 'off'
37    condition: selection_img and 1 of selection_cli_*
38falsepositives:
39    - Legitimate administration activity
40level: medium

References

• https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/

  
  Read More

• Analysis svchost.exe (MD5: 1605DC744FE86B41F44C69A13AA092E9) Malicious activity - Interactive analysis ANY.RUN

  

  Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

  
  Read More

• atomic-red-team/atomics/T1562.004/T1562.004.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

Related rules

• All Rules Have Been Deleted From The Windows Firewall Configuration
• Azure Firewall Modified or Deleted
• Azure Firewall Rule Collection Modified or Deleted
• Bpfdoor TCP Ports Redirect
• Disable Microsoft Defender Firewall via Registry