Windows netsh Enables Defender Firewall Group Rules via advfirewall set rule group new enable=Yes
Flags netsh.exe command lines that create and enable Microsoft Defender Firewall group rules (enable=Yes).
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-09
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation of netsh.exe commands that modify Microsoft Defender Firewall by setting a firewall rule for a specified group and enabling it (enable=Yes). Attackers can use firewall rule changes to weaken network access restrictions and bypass controls that limit inbound/outbound traffic. Telemetry relies on Windows process creation logs, specifically the executable name and command-line content containing the advfirewall/firewall/rule/group parameters.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall
- learn.microsoft.comhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows netsh Enables Defender Firewall Group Rules via advfirewall set rule group new enable=Yes
id: 8d7cc5ce-2677-4bb1-b2f9-e19e62582dbf
status: test
description: This rule matches process creation of netsh.exe commands that modify Microsoft Defender Firewall by setting a firewall rule for a specified group and enabling it (enable=Yes). Attackers can use firewall rule changes to weaken network access restrictions and bypass controls that limit inbound/outbound traffic. Telemetry relies on Windows process creation logs, specifically the executable name and command-line content containing the advfirewall/firewall/rule/group parameters.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml
author: frack113, Huntrule Team
date: 2022-01-09
modified: 2023-02-14
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
CommandLine|contains|all:
- advfirewall
- firewall
- set
- rule
- group=
- new
- enable=Yes
condition: all of selection_*
falsepositives:
- Legitimate administration activity
level: medium
license: DRL-1.1
related:
- id: 347906f3-e207-4d18-ae5b-a9403d6bcdef
type: derived