Detection rules › Splunk
Windows Firewall Disabled (Sysmon)
Adversaries may disable or windows firewalls in order to bypass controls enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '5995.18211'
title: Windows Firewall Disabled
description: 'Adversaries may disable or windows firewalls in order to bypass controls
enable adversary C2 communications, lateral movement, and/or data exfiltration that
would otherwise not be allowed. -- Threat Actor Association: APT41, Muddled Libra
- Software Association: Agent Tesla, BlackByte, Conti, Insekt, Lockbit, PurpleFox,
Prometheus / Spook, Ransom Cartel, Trickbot Atomics T1562.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
(TERM(netsh) (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR
(TERM(state) TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false))
OR ((TERM(sc) OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service))
TERM(windows) TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy)
TERM(EnableFirewall) TERM(0)) | table _time, host, user process, process_*, parent_*,
signature_id | bin span=1s | stats values(*) as * by _time, host | where match(process_name,
"(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe") '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- Windows Sysmon
references:
- https://us-cert.cisa.gov/sites/default/files/publications/MAR-10135536-G.PDF
- https://blogs.cisco.com/security/talos/opening-zxshell
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") (TERM(netsh) (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR (TERM(state) TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false)) OR ((TERM(sc) OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows) TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy) TERM(EnableFirewall) TERM(0))
Stage 2: table
| table _time, host, user process, process_*, parent_*, signature_id
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(process_name, "(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventCode=1" |
| 1 | "<EventID>1<" |
| 1 | netsh |
| 1 | firewall |
| 1 | advfirewall |
| 1 | set |
| 1 | "mode=disable" |
| 1 | state |
| 1 | off |
| 1 | NetFirewallProfile |
| 1 | "-Enabled" |
| 1 | false |
| 1 | sc |
| 1 | net |
| 1 | net1 |
| 1 | "sc.exe" |
| 1 | "net.exe" |
| 1 | "Stop-Service" |
| 1 | windows |
| 1 | firewall |
| 1 | REG |
| 1 | "reg.exe" |
| 1 | ADD |
| 1 | FirewallPolicy |
| 1 | EnableFirewall |
| 1 | 0 |