Detection rules › Sigma
OpenSSH server firewall configuration on Windows (firewall)
Detects scenarios where an attacker configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562.004 Impair Defenses: Disable or Modify System Firewall |
Event coverage
| Provider | Event |
|---|---|
| Windows-Firewall-With-Advanced-Security | Event ID 2004 |
Rule body yaml
title: OpenSSH server firewall configuration on Windows (firewall)
description: Detects scenarios where an attacker configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
- https://winaero.com/enable-openssh-server-windows-10/
- https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
- https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: firewall-as
detection:
selection_event:
EventID: 2004
selection_process: # New firewall rule creation (process focus)
ApplicationPath|endswith: '\sshd.exe' # full path 'C:\Windows\system32\OpenSSH\sshd.exe'
selection_port: # New firewall rule creation (port focus)
LocalPorts: 22 # Attackers may change port
condition: selection_event and (selection_process or selection_port)
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection_event and (selection_process or selection_port)Stage 1: selection_event
selection_event:
EventID: 2004
Stage 2: selection_process
selection_process:
ApplicationPath|endswith: '\sshd.exe'
Stage 3: selection_port
selection_port:
LocalPorts: 22
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ApplicationPath | ends_with |
|
LocalPorts | eq |
|