Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

Flags netsh.exe firewall allow rules that whitelist a program located in suspicious Windows filesystem paths.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-05-25
Updated: 2026-07-30

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of netsh.exe that attempt to add an inbound firewall rule allowing a specific program. It further flags commands that include “firewall”, “add”, “allowedprogram”, “advfirewall”, and “action=allow” with a “program=” parameter, where the program path matches common suspicious locations (e.g., recycle bin, system volume information, temp, downloads, and various user/public directories). Attackers may use firewall rule changes to maintain access or bypass network restrictions by legitimizing malicious binaries via allowedprogram settings. The detection relies on process creation telemetry including Image/OriginalFileName and the full command line content.

Reporting behind it

Related detections9 linkedT1686.003 — drag to rearrange

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Windows Firewall Exception Rule Added for Application in Suspicious Path

Windows Firewall Rules Deleted (Windows Defender Firewall) via Firewall-as Events

Windows Registry: Disable Firewall via EnableFirewall DWORD Policies

Windows Firewall rule deleted via netsh.exe command line

Windows Firewall Settings Change Events (Windows Firewall/Defender Firewall-AS)

Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)

Windows Defender Firewall Service Failed to Load Group Policy (Event ID 2009)

Windows Firewall exception rule deleted (Windows Firewall/Defender) EventID 2006/2052

Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

Pivot detection · T1686.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-netsh-exe-whitelists-allowed-program-from-suspicious-path-in-firewall-a35f5a72

title: Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall
id: db7429cb-0693-4a6d-89b3-a3baadc4a34c
status: test
description: This rule identifies process executions of netsh.exe that attempt to add an inbound firewall rule allowing a specific program. It further flags commands that include “firewall”, “add”, “allowedprogram”, “advfirewall”, and “action=allow” with a “program=” parameter, where the program path matches common suspicious locations (e.g., recycle bin, system volume information, temp, downloads, and various user/public directories). Attackers may use firewall rule changes to maintain access or bypass network restrictions by legitimizing malicious binaries via allowedprogram settings. The detection relies on process creation telemetry including Image/OriginalFileName and the full command line content.
references:
  - https://www.virusradar.com/en/Win32_Kasidet.AD/description
  - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml
author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-05-25
modified: 2023-12-11
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    - CommandLine|contains|all:
        - firewall
        - add
        - allowedprogram
    - CommandLine|contains|all:
        - advfirewall
        - firewall
        - add
        - rule
        - action=allow
        - program=
  selection_paths:
    CommandLine|contains:
      - :\$Recycle.bin\
      - :\RECYCLER.BIN\
      - :\RECYCLERS.BIN\
      - :\SystemVolumeInformation\
      - :\Temp\
      - :\Users\Default\
      - :\Users\Desktop\
      - :\Users\Public\
      - :\Windows\addins\
      - :\Windows\cursors\
      - :\Windows\debug\
      - :\Windows\drivers\
      - :\Windows\fonts\
      - :\Windows\help\
      - :\Windows\system32\tasks\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \Downloads\
      - \Local Settings\Temporary Internet Files\
      - \Temporary Internet Files\Content.Outlook\
      - "%Public%\\"
      - "%TEMP%"
      - "%TMP%"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a35f5a72-f347-4e36-8895-9869b0d5fc6d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL