OpenSSH server firewall configuration on Windows (PowerShell)

Status: experimental
Severity: high
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools `T1686` Disable or Modify System Firewall

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: OpenSSH server firewall configuration on Windows (PowerShell)
description: Detects scenarios where an attacker configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.
references:
 - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
 - https://winaero.com/enable-openssh-server-windows-10/
 - https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
 - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - New-NetFirewallRule
      - LocalPort
      - '22'
      - Action
      - Allow

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - New-NetFirewallRule
      - LocalPort
      - '22'
      - Action
      - Allow

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - New-NetFirewallRule
      - LocalPort
      - '22'
      - Action
      - Allow

  condition: 1 of selection*
falsepositives:
- Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - New-NetFirewallRule
    - LocalPort
    - '22'
    - Action
    - Allow

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - New-NetFirewallRule
    - LocalPort
    - '22'
    - Action
    - Allow

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - New-NetFirewallRule
    - LocalPort
    - '22'
    - Action
    - Allow

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`22` `Action` `Allow` `LocalPort` `New-NetFirewallRule`	`field:"EventData" kind:match`
`Payload`	match	`22` `Action` `Allow` `LocalPort` `New-NetFirewallRule`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`22` `Action` `Allow` corpus 3 (sigma 2, splunk 1) `LocalPort` `New-NetFirewallRule`	`field:"ScriptBlockText" kind:match`

OpenSSH server firewall configuration on Windows (PowerShell)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_powershell_native

Stage 2: selection_powershell_modern

Stage 3: selection_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection_powershell_native`

Stage 2: `selection_powershell_modern`

Stage 3: `selection_powershell_block`