huntrule

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

FreeUnreviewedSigmalowv1
title: Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)
id: 0f441ab3-a6f5-4528-9fb0-99fb94cb57db
status: test
description: This rule matches process executions of netsh.exe with command lines that include firewall inspection commands for configuration details. Adversaries can use this to enumerate firewall rules and states on a local or remote system to understand network access controls before further actions. It relies on Windows process creation telemetry, specifically the executable name/path and the presence of the relevant netsh command fragments in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules
  - https://ss64.com/nt/netsh.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2021-12-07
modified: 2025-10-18
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - netsh
      - "show "
      - "firewall "
    CommandLine|contains:
      - "config "
      - "state "
      - "rule "
      - name=all
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: low
license: DRL-1.1
related:
  - id: 0e4164da-94bc-450d-a7be-a4b176179f1f
    type: derived

What it detects

This rule matches process executions of netsh.exe with command lines that include firewall inspection commands for configuration details. Adversaries can use this to enumerate firewall rules and states on a local or remote system to understand network access controls before further actions. It relies on Windows process creation telemetry, specifically the executable name/path and the presence of the relevant netsh command fragments in the command line.

Known false positives

  • Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.