Windows Firewall Allow Rule Added via WmiPrvSE.exe

title: Windows Firewall Allow Rule Added via WmiPrvSE.exe
id: 2e401d54-6ca9-4412-a1b7-1b43468af1f9
status: test
description: This rule identifies when a new Windows Defender Firewall allow rule is added to the exception list and the modifying application is WmiPrvSE.exe. Adding firewall exceptions can enable persistence or facilitate inbound/outbound access while bypassing host network controls. Telemetry relies on Windows Firewall audit events (Event IDs 2004, 2071, 2097) that record the rule addition and the application responsible, matching when it ends with the WMI provider process path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
  - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
  - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-05-10
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2004
      - 2071
      - 2097
    Action: 3
    ModifyingApplication|endswith: :\Windows\System32\wbem\WmiPrvSE.exe
  condition: selection
falsepositives:
  - Administrator scripts or activity.
level: medium
license: DRL-1.1
related:
  - id: eca81e8d-09e1-4d04-8614-c91f44fd0519
    type: derived