Firewall Disabled via Netsh.EXE
Detects netsh commands that turns off the Windows firewall
Sigma rule (View on GitHub)
1title: Firewall Disabled via Netsh.EXE
2id: 57c4bf16-227f-4394-8ec7-1b745ee061c3
3status: test
4description: Detects netsh commands that turns off the Windows firewall
5references:
6 - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
7 - https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
8 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall
9author: Fatih Sirin
10date: 2019-11-01
11modified: 2023-02-13
12tags:
13 - attack.defense-evasion
14 - attack.t1562.004
15 - attack.s0108
16logsource:
17 category: process_creation
18 product: windows
19detection:
20 selection_img:
21 - Image|endswith: '\netsh.exe'
22 - OriginalFileName: 'netsh.exe'
23 selection_cli_1:
24 # Example: netsh firewall set opmode disable
25 CommandLine|contains|all:
26 - 'firewall'
27 - 'set'
28 - 'opmode'
29 - 'disable'
30 selection_cli_2:
31 # Example: netsh advfirewall set currentprofile state off
32 CommandLine|contains|all:
33 - 'advfirewall'
34 - 'set'
35 - 'state'
36 - 'off'
37 condition: selection_img and 1 of selection_cli_*
38falsepositives:
39 - Legitimate administration activity
40level: medium
References
-
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
Read More -
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More
Related rules
- Azure Firewall Modified or Deleted
- Azure Firewall Rule Collection Modified or Deleted
- Bpfdoor TCP Ports Redirect
- Disable Microsoft Defender Firewall via Registry
- Disable System Firewall