huntrule

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' (SigmaHQ), DRL 1.1
Published
2021-12-07
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches process executions of netsh.exe with command lines that include firewall inspection commands for configuration details. Adversaries can use this to enumerate firewall rules and states on a local or remote system to understand network access controls before further actions. It relies on Windows process creation telemetry, specifically the executable name/path and the presence of the relevant netsh command fragments in the command line.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange
Suspicious Codepage Change Followed By Nltest Domain Trust Discovery
Suspicious Domain Trust Discovery Via Nltest
Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)
Suspicious Scheduled Task Enumerated (via process_creation)
Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)
Suspicious External IP Discovery via curl to ifconfig.me via process_creation
Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)
Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)
Pivot detection · T1016 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.