Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

title: Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall
id: db7429cb-0693-4a6d-89b3-a3baadc4a34c
status: test
description: This rule identifies process executions of netsh.exe that attempt to add an inbound firewall rule allowing a specific program. It further flags commands that include “firewall”, “add”, “allowedprogram”, “advfirewall”, and “action=allow” with a “program=” parameter, where the program path matches common suspicious locations (e.g., recycle bin, system volume information, temp, downloads, and various user/public directories). Attackers may use firewall rule changes to maintain access or bypass network restrictions by legitimizing malicious binaries via allowedprogram settings. The detection relies on process creation telemetry including Image/OriginalFileName and the full command line content.
references:
  - https://www.virusradar.com/en/Win32_Kasidet.AD/description
  - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml
author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-05-25
modified: 2023-12-11
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    - CommandLine|contains|all:
        - firewall
        - add
        - allowedprogram
    - CommandLine|contains|all:
        - advfirewall
        - firewall
        - add
        - rule
        - action=allow
        - program=
  selection_paths:
    CommandLine|contains:
      - :\$Recycle.bin\
      - :\RECYCLER.BIN\
      - :\RECYCLERS.BIN\
      - :\SystemVolumeInformation\
      - :\Temp\
      - :\Users\Default\
      - :\Users\Desktop\
      - :\Users\Public\
      - :\Windows\addins\
      - :\Windows\cursors\
      - :\Windows\debug\
      - :\Windows\drivers\
      - :\Windows\fonts\
      - :\Windows\help\
      - :\Windows\system32\tasks\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \Downloads\
      - \Local Settings\Temporary Internet Files\
      - \Temporary Internet Files\Content.Outlook\
      - "%Public%\\"
      - "%TEMP%"
      - "%TMP%"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a35f5a72-f347-4e36-8895-9869b0d5fc6d
    type: derived