PowerShell Local Firewall Rule Enumeration Using Get-NetFirewallRule/Show-NetFirewallRule

title: PowerShell Local Firewall Rule Enumeration Using Get-NetFirewallRule/Show-NetFirewallRule
id: f5dae52f-1d01-405e-ba9b-afdec9bbe4bf
status: test
description: This rule detects PowerShell command execution containing either Get-NetFirewallRule or Show-NetFirewallRule, indicating enumeration of local firewall rules on a host. Attackers commonly gather firewall configuration details to understand what traffic is allowed or blocked before attempting access or lateral movement. The detection relies on process telemetry capturing PowerShell module payload and ContextInfo strings that include these cmdlets.
references:
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_module/posh_pm_susp_netfirewallrule_recon.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-07-13
tags:
  - detection.threat-hunting
  - attack.discovery
  - attack.t1518.001
  - attack.t1016
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_payload:
    Payload|contains:
      - Get-NetFirewallRule
      - Show-NetFirewallRule
  selection_contextinfo:
    ContextInfo|contains:
      - Get-NetFirewallRule
      - Show-NetFirewallRule
  condition: 1 of selection_*
falsepositives:
  - Administration scripts
level: low
license: DRL-1.1
related:
  - id: ea207a23-b441-4a17-9f76-ad5be47d51d3
    type: derived