Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation
Flags netsh.exe commands that add firewall rules allowing TCP port 3389 (RDP).
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Sander Wiebing (SigmaHQ), DRL 1.1
- Published
- 2020-05-23
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of netsh.exe that include command-line arguments for adding a firewall rule permitting TCP port 3389 (RDP). Attackers may use built-in networking and firewall tooling to expose or maintain remote access by opening the RDP port. Telemetry relies on Windows process creation data, including the executed image name and full command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-rdp-port-3389-allowed-via-netsh-exe-firewall-rule-creation-01aeb693
title: Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation
id: 9c245927-a90f-43b0-8c24-4f4bafb6e718
status: test
description: This rule identifies process executions of netsh.exe that include command-line arguments for adding a firewall rule permitting TCP port 3389 (RDP). Attackers may use built-in networking and firewall tooling to expose or maintain remote access by opening the RDP port. Telemetry relies on Windows process creation data, including the executed image name and full command line.
references:
- https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml
author: Sander Wiebing, Huntrule Team
date: 2020-05-23
modified: 2023-12-11
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
CommandLine|contains|all:
- "firewall "
- "add "
- "tcp "
- "3389"
CommandLine|contains:
- portopening
- allow
condition: all of selection_*
falsepositives:
- Legitimate administration activity
level: high
license: DRL-1.1
related:
- id: 01aeb693-138d-49d2-9403-c4f52d7d3d62
type: derived