Detection rules › Sigma

Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet

Status
test
Severity
low
Log source
category ps_module, product windows
Author
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Source
github.com/SigmaHQ/sigma

Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.

Known false positives

  • Administration scripts

MITRE ATT&CK coverage

Telemetry coverage

Rule body

title: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
id: ea207a23-b441-4a17-9f76-ad5be47d51d3
status: test
description: Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
references:
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
date: 2023-07-13
tags:
    - detection.threat-hunting
    - attack.discovery
    - attack.t1518.001
    - attack.t1016
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_payload:
        Payload|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    selection_contextinfo:
        ContextInfo|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    condition: 1 of selection_*
falsepositives:
    - Administration scripts
level: low

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_payload

selection_payload:
    Payload|contains:
        - 'Get-NetFirewallRule'
        - 'Show-NetFirewallRule'

Stage 2: selection_contextinfo

selection_contextinfo:
    ContextInfo|contains:
        - 'Get-NetFirewallRule'
        - 'Show-NetFirewallRule'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ContextInfomatch
  • Get-NetFirewallRule
  • Show-NetFirewallRule
field:"ContextInfo" kind:match
Payloadmatch
  • Get-NetFirewallRule corpus 2 (sigma 2)
  • Show-NetFirewallRule
field:"Payload" kind:match