Windows PowerShell: Windows Firewall Profile Disabled via Set-NetFirewallProfile

title: "Windows PowerShell: Windows Firewall Profile Disabled via Set-NetFirewallProfile"
id: 180ccf49-12a0-42b9-a438-f8802cce6d84
related:
  - id: 12f6b752-042d-483e-bf9c-915a6d06ad75
    type: similar
  - id: 488b44e7-3781-4a71-888d-c95abfacf44d
    type: derived
status: test
description: This rule identifies PowerShell script blocks that disable Windows Firewall using Set-NetFirewallProfile with -Enabled False. Disabling firewall protections can help attackers evade network-based defenses and reduce monitoring effectiveness. It relies on Script Block Logging telemetry capturing the relevant command text within PowerShell execution.
references:
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps
  - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
  - https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
  - http://woshub.com/manage-windows-firewall-powershell/
  - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-12
modified: 2022-12-30
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_args:
    ScriptBlockText|contains|all:
      - "Set-NetFirewallProfile "
      - " -Enabled "
      - " False"
  selection_opt:
    ScriptBlockText|contains:
      - " -All "
      - Public
      - Domain
      - Private
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1