Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

FreeReviewedSigma · Low · v1

Product: windows
Category: process_creation
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' (SigmaHQ), DRL 1.1
Published: 2021-12-07
Updated: 2026-07-30

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process executions of netsh.exe with command lines that include firewall inspection commands for configuration details. Adversaries can use this to enumerate firewall rules and states on a local or remote system to understand network access controls before further actions. It relies on Windows process creation telemetry, specifically the executable name/path and the presence of the relevant netsh command fragments in the command line.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Pivot detection · T1016 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-netsh-exe-firewall-configuration-discovery-show-firewall-rule-state-name-0e4164da

title: Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)
id: 0f441ab3-a6f5-4528-9fb0-99fb94cb57db
status: test
description: This rule matches process executions of netsh.exe with command lines that include firewall inspection commands for configuration details. Adversaries can use this to enumerate firewall rules and states on a local or remote system to understand network access controls before further actions. It relies on Windows process creation telemetry, specifically the executable name/path and the presence of the relevant netsh command fragments in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules
  - https://ss64.com/nt/netsh.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2021-12-07
modified: 2025-10-18
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - netsh
      - "show "
      - "firewall "
    CommandLine|contains:
      - "config "
      - "state "
      - "rule "
      - name=all
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: low
license: DRL-1.1
related:
  - id: 0e4164da-94bc-450d-a7be-a4b176179f1f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL