Windows netsh.exe Advanced Firewall Rule Set Modification
Flags netsh.exe command lines that invoke advfirewall firewall set to modify existing Windows firewall rule properties.
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-18
- Updated
- 2026-07-30
What it detects
This rule identifies process executions of netsh.exe that include the advanced firewall context and the set operation to modify properties of an existing firewall rule. Attackers may use this capability to weaken host network controls or to establish inbound/outbound access by changing firewall settings. The detection relies on Windows process creation telemetry, specifically the executable name/path and command-line substrings indicating 'firewall' and 'set' under 'advfirewall'.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows netsh.exe Advanced Firewall Rule Set Modification
id: 79d31c08-1742-4f20-836f-e38f4bd4b485
status: test
description: This rule identifies process executions of netsh.exe that include the advanced firewall context and the set operation to modify properties of an existing firewall rule. Attackers may use this capability to weaken host network controls or to establish inbound/outbound access by changing firewall settings. The detection relies on Windows process creation telemetry, specifically the executable name/path and command-line substrings indicating 'firewall' and 'set' under 'advfirewall'.
references:
- https://ss64.com/nt/netsh.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-18
tags:
- attack.defense-impairment
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
CommandLine|contains|all:
- " firewall "
- " set "
condition: all of selection_*
falsepositives:
- Legitimate administration activity
- Software installations and removal
level: medium
license: DRL-1.1
related:
- id: a70dcb37-3bee-453a-99df-d0c683151be6
type: derived