Windows Firewall Disabled (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may disable or windows firewalls in order to bypass controls enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools `T1686` Disable or Modify System Firewall

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '5995.6370'
title: Windows Firewall Disabled
description: 'Adversaries may disable or windows firewalls in order to bypass controls
  enable adversary C2 communications, lateral movement, and/or data exfiltration that
  would otherwise not be allowed. -- Threat Actor Association: APT41, Muddled Libra
  - Software Association: Agent Tesla, BlackByte, Conti, Insekt, Lockbit, PurpleFox,
  Prometheus / Spook, Ransom Cartel, Trickbot Atomics T1562.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(netsh)
  (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR (TERM(state)
  TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false)) OR ((TERM(sc)
  OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows)
  TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy) TERM(EnableFirewall)
  TERM(0)) | table _time, host, user process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | where match(process_name, "(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe") '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://us-cert.cisa.gov/sites/default/files/publications/MAR-10135536-G.PDF
- https://blogs.cisco.com/security/talos/opening-zxshell

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(netsh) (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR (TERM(state) TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false)) OR ((TERM(sc) OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows) TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy) TERM(EnableFirewall) TERM(0))

Stage 2: `table`

| table _time, host, user process, process_*, signature_id

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `where`

| where match(process_name, "(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`
`process_name`	regex_match	`"(?i)cmd` `powershell` `netsh` `net1?` `sc.exe` `reg.exe"` corpus 3 (splunk 3)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`netsh`
1	`firewall`
1	`advfirewall`
1	`set`
1	`"mode=disable"`
1	`state`
1	`off`
1	`NetFirewallProfile`
1	`"-Enabled"`
1	`false`
1	`sc`
1	`net`
1	`net1`
1	`"sc.exe"`
1	`"net.exe"`
1	`"Stop-Service"`
1	`windows`
1	`firewall`
1	`REG`
1	`"reg.exe"`
1	`ADD`
1	`FirewallPolicy`
1	`EnableFirewall`
1	`0`