huntrule

Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation

Flags netsh.exe commands that add firewall rules allowing TCP port 3389 (RDP).

FreeUnreviewedSigmahighv1
title: Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation
id: 9c245927-a90f-43b0-8c24-4f4bafb6e718
status: test
description: This rule identifies process executions of netsh.exe that include command-line arguments for adding a firewall rule permitting TCP port 3389 (RDP). Attackers may use built-in networking and firewall tooling to expose or maintain remote access by opening the RDP port. Telemetry relies on Windows process creation data, including the executed image name and full command line.
references:
  - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml
author: Sander Wiebing, Huntrule Team
date: 2020-05-23
modified: 2023-12-11
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - "firewall "
      - "add "
      - "tcp "
      - "3389"
    CommandLine|contains:
      - portopening
      - allow
  condition: all of selection_*
falsepositives:
  - Legitimate administration activity
level: high
license: DRL-1.1
related:
  - id: 01aeb693-138d-49d2-9403-c4f52d7d3d62
    type: derived

What it detects

This rule identifies process executions of netsh.exe that include command-line arguments for adding a firewall rule permitting TCP port 3389 (RDP). Attackers may use built-in networking and firewall tooling to expose or maintain remote access by opening the RDP port. Telemetry relies on Windows process creation data, including the executed image name and full command line.

Known false positives

  • Legitimate administration activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.