Windows Firewall rule deleted via netsh.exe command line

title: Windows Firewall rule deleted via netsh.exe command line
id: 93eb1615-e164-4981-b543-361c27c6cfdf
status: test
description: This rule identifies process executions of netsh.exe where the command line includes the firewall delete action (e.g., containing both 'firewall' and 'delete '). Removing firewall rules can reduce host network protections and enable follow-on access. It relies on Windows process creation telemetry, matching the netsh.exe process image and its command-line arguments, with exclusions for Dropbox and the Avast installer path/commands seen as optional drops.
references:
  - https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml
author: frack113, Huntrule Team
date: 2022-08-14
modified: 2025-10-07
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - firewall
      - "delete "
  filter_optional_dropbox:
    ParentImage|endswith: \Dropbox.exe
    CommandLine|contains: name=Dropbox
  filter_optional_avast:
    ParentImage|endswith: \instup.exe
    CommandLine|contains: advfirewall firewall delete rule name="Avast Antivirus Admin Client"
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate administration activity
  - Software installations and removal
level: medium
license: DRL-1.1
related:
  - id: 1a5fefe6-734f-452e-a07d-fc1c35bce4b2
    type: derived