Windows Firewall Rule Added via netsh.exe

title: Windows Firewall Rule Added via netsh.exe
id: b196d28f-d9c8-4518-aaa1-aab00c063c33
status: test
description: This rule identifies process executions of netsh.exe where the command line includes terms for adding a firewall rule. Attackers may use netsh to create inbound allow rules that facilitate persistence, remote access, or bypassing host-based network controls. The detection relies on Windows process creation telemetry, matching the netsh.exe executable and specific firewall add command-line content.
references:
  - https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml
author: Markus Neis, Sander Wiebing, Huntrule Team
date: 2019-01-29
modified: 2023-02-10
tags:
  - attack.defense-impairment
  - attack.t1686.003
  - attack.s0246
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - " firewall "
      - " add "
  filter_optional_dropbox:
    CommandLine|contains:
      - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any
      - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files\Dropbox\Client\Dropbox.exe" enable=yes profile=Any
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate administration activity
  - Software installations
level: medium
license: DRL-1.1
related:
  - id: cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c
    type: derived