Windows Firewall Rule Creation (PowerShell)

id: '8328.10392'
title: Windows Firewall Rule Creation
description: 'Windows has several utility used to interact with networking components
  on local or remote systems. This use case looks for firewall rules added with netsh
  or New-NetFirewallRule. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, APT35/Phosphorus/Magic
  Hound, BlackCat, Magnat, TA428, Volt Typhoon -- Software Association: BianLian,
  BlackByte, Black Basta, Insekt, Lockbit, Trigona -- Atomics T1021.001 Test #3 Atomics
  T1021.001 Test #4 Atomics T1562.004 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104)) New-NetFirewallRule | table _time, host, user, event_id, signature_id,
  process_*, process | rex field=process (?<ioc>"(?i)New-NetFirewallRule.{1,25}")
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
- https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)?redirectedfrom=MSDN
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps