Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall
Flags netsh.exe firewall allow rules that whitelist a program located in suspicious Windows filesystem paths.
- Product
- windows
- Category
- process_creation
- Author
- Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-05-25
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of netsh.exe that attempt to add an inbound firewall rule allowing a specific program. It further flags commands that include “firewall”, “add”, “allowedprogram”, “advfirewall”, and “action=allow” with a “program=” parameter, where the program path matches common suspicious locations (e.g., recycle bin, system volume information, temp, downloads, and various user/public directories). Attackers may use firewall rule changes to maintain access or bypass network restrictions by legitimizing malicious binaries via allowedprogram settings. The detection relies on process creation telemetry including Image/OriginalFileName and the full command line content.
Reporting behind it
- virusradar.comhttps://www.virusradar.com/en/Win32_Kasidet.AD/description
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall
id: db7429cb-0693-4a6d-89b3-a3baadc4a34c
status: test
description: This rule identifies process executions of netsh.exe that attempt to add an inbound firewall rule allowing a specific program. It further flags commands that include “firewall”, “add”, “allowedprogram”, “advfirewall”, and “action=allow” with a “program=” parameter, where the program path matches common suspicious locations (e.g., recycle bin, system volume information, temp, downloads, and various user/public directories). Attackers may use firewall rule changes to maintain access or bypass network restrictions by legitimizing malicious binaries via allowedprogram settings. The detection relies on process creation telemetry including Image/OriginalFileName and the full command line content.
references:
- https://www.virusradar.com/en/Win32_Kasidet.AD/description
- https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml
author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-05-25
modified: 2023-12-11
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
- CommandLine|contains|all:
- firewall
- add
- allowedprogram
- CommandLine|contains|all:
- advfirewall
- firewall
- add
- rule
- action=allow
- program=
selection_paths:
CommandLine|contains:
- :\$Recycle.bin\
- :\RECYCLER.BIN\
- :\RECYCLERS.BIN\
- :\SystemVolumeInformation\
- :\Temp\
- :\Users\Default\
- :\Users\Desktop\
- :\Users\Public\
- :\Windows\addins\
- :\Windows\cursors\
- :\Windows\debug\
- :\Windows\drivers\
- :\Windows\fonts\
- :\Windows\help\
- :\Windows\system32\tasks\
- :\Windows\Tasks\
- :\Windows\Temp\
- \Downloads\
- \Local Settings\Temporary Internet Files\
- \Temporary Internet Files\Content.Outlook\
- "%Public%\\"
- "%TEMP%"
- "%TMP%"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a35f5a72-f347-4e36-8895-9869b0d5fc6d
type: derived