Detection rules › Sigma
Firewall rule creation (command)
Detects scenarios where an attacker attempts to create a firewall rule to allow unauthorized communications.
Known false positives
- Administrator activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Firewall rule creation (command)
description: Detects scenarios where an attacker attempts to create a firewall rule to allow unauthorized communications.
references:
- https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection: # netsh firewall add portopening TCP 80 "Open Port 80"
selection_event:
EventID: 4688
NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
Commandline|contains|all:
- netsh
- firewall # covers also advfirewall
- add
condition: selection
falsepositives:
- Administrator activity
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection_event
selection_event:
EventID: 4688
NewProcessName|endswith: '\netsh.exe'
Commandline|contains|all:
- netsh
- firewall
- add
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Commandline | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\netsh.exe" |