Firewall Disabled via Netsh.EXE

calendar Feb 13, 2023 · attack.defense_evasion attack.t1562.004 attack.s0108  ·
Share on: linkedin copy

Detects netsh commands that turns off the Windows firewall

Sigma rule (View on GitHub)

 1title: Firewall Disabled via Netsh.EXE
 2id: 57c4bf16-227f-4394-8ec7-1b745ee061c3
 3status: test
 4description: Detects netsh commands that turns off the Windows firewall
 5references:
 6    - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
 7    - https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
 8    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall
 9author: Fatih Sirin
10date: 2019/11/01
11modified: 2023/02/13
12tags:
13    - attack.defense_evasion
14    - attack.t1562.004
15    - attack.s0108
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection_img:
21        - Image|endswith: '\netsh.exe'
22        - OriginalFileName: 'netsh.exe'
23    selection_cli_1:
24        # Example: netsh firewall set opmode disable
25        CommandLine|contains|all:
26            - 'firewall'
27            - 'set'
28            - 'opmode'
29            - 'disable'
30    selection_cli_2:
31        # Example: netsh advfirewall set currentprofile state off
32        CommandLine|contains|all:
33            - 'advfirewall'
34            - 'set'
35            - 'state'
36            - 'off'
37    condition: selection_img and 1 of selection_cli_*
38falsepositives:
39    - Legitimate administration activity
40level: medium

References

Related rules

to-top