Firewall Policy Changed by a Suspicious Process

[rule]
description = """
Identifies attempts to modify the Windows Firewall Policy in order to permit an unsigned executable that was recently
introduced. Malicious software frequently employs such alterations during installation to ensure uninterrupted network
connectivity.
"""
id = "bf072c39-90bc-4b1b-9c78-1d8a9bd6f0e1"
license = "Elastic License v2"
name = "Firewall Policy Changed by a Suspicious Process"
os_list = ["windows"]
version = "1.0.7"

query = '''
sequence with maxspan=1m 
[process where event.action == "start" and 
(
 ((process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  not process.code_signature.status : ("errorExpired", "errorCode_endpoint*") and
  (process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*") or
   process.executable regex~ """c:\\windows\\[a-z0-9\-\_\.]+\.exe""")) or 

   process.executable : "?:\\Windows\\Microsoft.NET\\*" or 

   (process.code_signature.subject_name : "NetSupport Ltd" and process.Ext.relative_file_creation_time <= 500 and 
    not process.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe"))
 ) and
 not process.hash.sha256 in ("0f418b6eda02552ef104a836a8ba812ddcfae11506dc96cae71b719046cd749c",
                             "4cdb4fd1bb7a23c802abb6b5c0a973679495154b17a2234ea19e11fd0c8a2b0a",
                             "7d766d78c07024537114c7ddaec864810cac822719caf13ff738b52c2b663c75",
                             "e3fb22644ccfe21f511848e516c172802b9b6513625af1e5877e9dd88e8fe477") and
 not (process.executable : "?:\\ProgramData\\checkmk\\agent\\bin\\cmk-agent-ctl.exe" and
      process.parent.executable : ("?:\\Program Files\\checkmk\\service\\check_mk_agent.exe",
                                   "?:\\Program Files (x86)\\checkmk\\service\\check_mk_agent.exe")) and
not (process.code_signature.subject_name : "Incredibuild Software ltd." and process.code_signature.trusted == true)
] as event0 
[registry where 
  registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" and 
  registry.data.strings : "*Allow*Public|*" and stringcontains~(registry.data.strings, event0.process.executable)]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"