Windows netsh.exe Advanced Firewall Rule Set Modification

Flags netsh.exe command lines that invoke advfirewall firewall set to modify existing Windows firewall rule properties.

FreeUnreviewedSigmamediumv1

windows-netsh-exe-advanced-firewall-rule-set-modification-a70dcb37

title: Windows netsh.exe Advanced Firewall Rule Set Modification
id: 79d31c08-1742-4f20-836f-e38f4bd4b485
status: test
description: This rule identifies process executions of netsh.exe that include the advanced firewall context and the set operation to modify properties of an existing firewall rule. Attackers may use this capability to weaken host network controls or to establish inbound/outbound access by changing firewall settings. The detection relies on Windows process creation telemetry, specifically the executable name/path and command-line substrings indicating 'firewall' and 'set' under 'advfirewall'.
references:
  - https://ss64.com/nt/netsh.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-18
tags:
  - attack.defense-impairment
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - " firewall "
      - " set "
  condition: all of selection_*
falsepositives:
  - Legitimate administration activity
  - Software installations and removal
level: medium
license: DRL-1.1
related:
  - id: a70dcb37-3bee-453a-99df-d0c683151be6
    type: derived

What it detects

This rule identifies process executions of netsh.exe that include the advanced firewall context and the set operation to modify properties of an existing firewall rule. Attackers may use this capability to weaken host network controls or to establish inbound/outbound access by changing firewall settings. The detection relies on Windows process creation telemetry, specifically the executable name/path and command-line substrings indicating 'firewall' and 'set' under 'advfirewall'.

Known false positives

Legitimate administration activity
Software installations and removal

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.