Windows System Network Connections Discovery Netsh

name: Windows System Network Connections Discovery Netsh
id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca
version: 12
creation_date: '2022-12-06'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the Windows built-in tool netsh.exe to display the state, configuration, and profile of the host firewall. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. Monitoring this activity is crucial as netsh.exe can be used by adversaries to bypass firewall rules or discover firewall settings. If confirmed malicious, this activity could allow attackers to manipulate firewall configurations, potentially leading to unauthorized network access or data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    
    FROM datamodel=Endpoint.Processes WHERE
    
    `process_netsh`
    Processes.process="* show *"
    Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*")
    
    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_system_network_connections_discovery_netsh_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Network administrators, power users, and third party tools can and will use this utility for various purposes. Apply the necessary filters by user, parent process, and command line.
references:
    - https://attack.mitre.org/techniques/T1049/
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: netsh process with command line $process$ on $dest$
analytic_story:
    - Windows Post-Exploitation
    - Prestige Ransomware
    - Snake Keylogger
    - BlankGrabber Stealer
    - VIP Keylogger
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1049
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint