Detection rules › Splunk
Windows Firewall Disabled (Sysmon)
Adversaries may disable or windows firewalls in order to bypass controls enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562.004 Impair Defenses: Disable or Modify System Firewall |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '5995.18211'
title: Windows Firewall Disabled
description: 'Adversaries may disable or windows firewalls in order to bypass controls
enable adversary C2 communications, lateral movement, and/or data exfiltration that
would otherwise not be allowed. -- Threat Actor Association: APT41, Muddled Libra
- Software Association: Agent Tesla, BlackByte, Conti, Insekt, Lockbit, PurpleFox,
Prometheus / Spook, Ransom Cartel, Trickbot Atomics T1562.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
(TERM(netsh) (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR
(TERM(state) TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false))
OR ((TERM(sc) OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service))
TERM(windows) TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy)
TERM(EnableFirewall) TERM(0)) | table _time, host, user process, process_*, parent_*,
signature_id | bin span=1s | stats values(*) as * by _time, host | where match(process_name,
"(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe") '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- Windows Sysmon
references:
- https://us-cert.cisa.gov/sites/default/files/publications/MAR-10135536-G.PDF
- https://blogs.cisco.com/security/talos/opening-zxshell
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") (TERM(netsh) (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR (TERM(state) TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false)) OR ((TERM(sc) OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows) TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy) TERM(EnableFirewall) TERM(0))
Stage 2: table
| table _time, host, user process, process_*, parent_*, signature_id
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(process_name, "(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "EventCode=1" |
| 1 | "<EventID>1<" |
| 1 | TERM |
| 1 | netsh |
| 1 | TERM |
| 1 | firewall |
| 1 | TERM |
| 1 | advfirewall |
| 1 | TERM |
| 1 | set |
| 1 | "mode=disable" |
| 1 | TERM |
| 1 | state |
| 1 | TERM |
| 1 | off |
| 1 | TERM |
| 1 | NetFirewallProfile |
| 1 | "-Enabled" |
| 1 | TERM |
| 1 | false |
| 1 | TERM |
| 1 | sc |
| 1 | TERM |
| 1 | net |
| 1 | TERM |
| 1 | net1 |
| 1 | "sc.exe" |
| 1 | "net.exe" |
| 1 | "Stop-Service" |
| 1 | TERM |
| 1 | windows |
| 1 | TERM |
| 1 | firewall |
| 1 | TERM |
| 1 | REG |
| 1 | "reg.exe" |
| 1 | TERM |
| 1 | ADD |
| 1 | TERM |
| 1 | FirewallPolicy |
| 1 | TERM |
| 1 | EnableFirewall |
| 1 | TERM |
| 1 | 0 |