Detection rules › Sigma
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1016 System Network Configuration Discovery, T1518.001 Software Discovery: Security Software Discovery |
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
Rule body yaml
title: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
id: ea207a23-b441-4a17-9f76-ad5be47d51d3
status: test
description: Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
references:
- https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
- https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
date: 2023-07-13
tags:
- detection.threat-hunting
- attack.discovery
- attack.t1518.001
- attack.t1016
logsource:
product: windows
category: ps_module
definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
selection_payload:
Payload|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
selection_contextinfo:
ContextInfo|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
condition: 1 of selection_*
falsepositives:
- Administration scripts
level: low
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_payload
selection_payload:
Payload|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
Stage 2: selection_contextinfo
selection_contextinfo:
ContextInfo|contains:
- 'Get-NetFirewallRule'
- 'Show-NetFirewallRule'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ContextInfo | match |
|
Payload | match |
|