Detection rules › Sigma
Firewall rule any/any created
Detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.
Known false positives
- Firewall rule debugging
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
Rule body
title: Firewall rule any/any created
description: Detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.004-Impair%20Defenses-Disable%20or%20Modify%20System%20Firewall
- https://kb.eventtracker.com/evtpass/evtPages/EventId_2004_Microsoft-Windows-WindowsFirewallwithAdvancedS_65673.asp
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: firewall-as
detection:
selection_basic:
EventID:
- 2004 # new rule created
- 2005 # existing rule modified
Action: 3 # allow
selection_any_port:
LocalPorts: '*'
RemotePorts: '*'
selection_any_address:
LocalAddresses: '*'
RemoteAddresses: '*'
condition: selection_basic and (selection_any_port or selection_any_address)
falsepositives:
- Firewall rule debugging
level: high
Stages and Predicates
Stage 0: condition
selection_basic and (selection_any_port or selection_any_address)Stage 1: selection_basic
selection_basic:
EventID:
- 2004
- 2005
Action: 3
Stage 2: selection_any_port
selection_any_port:
LocalPorts: '*'
RemotePorts: '*'
Stage 3: selection_any_address
selection_any_address:
LocalAddresses: '*'
RemoteAddresses: '*'
Indicators
These rows show field, operator, and value matches.