Windows Firewall rule deleted via netsh.exe command line
Flags netsh.exe executions that contain Windows Firewall rule deletion commands.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-08-14
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of netsh.exe where the command line includes the firewall delete action (e.g., containing both 'firewall' and 'delete '). Removing firewall rules can reduce host network protections and enable follow-on access. It relies on Windows process creation telemetry, matching the netsh.exe process image and its command-line arguments, with exclusions for Dropbox and the Avast installer path/commands seen as optional drops.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall rule deleted via netsh.exe command line
id: 93eb1615-e164-4981-b543-361c27c6cfdf
status: test
description: This rule identifies process executions of netsh.exe where the command line includes the firewall delete action (e.g., containing both 'firewall' and 'delete '). Removing firewall rules can reduce host network protections and enable follow-on access. It relies on Windows process creation telemetry, matching the netsh.exe process image and its command-line arguments, with exclusions for Dropbox and the Avast installer path/commands seen as optional drops.
references:
- https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml
author: frack113, Huntrule Team
date: 2022-08-14
modified: 2025-10-07
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
CommandLine|contains|all:
- firewall
- "delete "
filter_optional_dropbox:
ParentImage|endswith: \Dropbox.exe
CommandLine|contains: name=Dropbox
filter_optional_avast:
ParentImage|endswith: \instup.exe
CommandLine|contains: advfirewall firewall delete rule name="Avast Antivirus Admin Client"
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Legitimate administration activity
- Software installations and removal
level: medium
license: DRL-1.1
related:
- id: 1a5fefe6-734f-452e-a07d-fc1c35bce4b2
type: derived