Detection rules › Sigma
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
Known false positives
- Administration scripts
MITRE ATT&CK coverage
Telemetry coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4103: Payload Context: ContextInfo User Data: UserData. |
Rule body
title: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
id: ea207a23-b441-4a17-9f76-ad5be47d51d3
status: test
description: Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
references:
- https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
- https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
date: 2023-07-13
tags:
- detection.threat-hunting
- attack.discovery
- attack.t1518.001
- attack.t1016
logsource:
product: windows
category: ps_module
definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
selection_payload:
Payload|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
selection_contextinfo:
ContextInfo|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
condition: 1 of selection_*
falsepositives:
- Administration scripts
level: low
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_payload
selection_payload:
Payload|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
Stage 2: selection_contextinfo
selection_contextinfo:
ContextInfo|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ContextInfo | match |
| field:"ContextInfo" kind:match |
Payload | match |
| field:"Payload" kind:match |