sigmalowHunting

Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet

Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.

MITRE ATT&CK

discovery

Detection Query

selection_payload:
  Payload|contains:
    - Get-NetFirewallRule
    - Show-NetFirewallRule
selection_contextinfo:
  ContextInfo|contains:
    - Get-NetFirewallRule
    - Show-NetFirewallRule
condition: 1 of selection_*

Author

Christopher Peacock @SecurePeacock, SCYTHE @scythe_io

Created

2023-07-13

Data Sources

windowsps_module

Platforms

windows

References

Tags

detection.threat-huntingattack.discoveryattack.t1518.001attack.t1016

Raw Content

title: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
id: ea207a23-b441-4a17-9f76-ad5be47d51d3
status: test
description: Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
references:
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
date: 2023-07-13
tags:
    - detection.threat-hunting
    - attack.discovery
    - attack.t1518.001
    - attack.t1016
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_payload:
        Payload|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    selection_contextinfo:
        ContextInfo|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    condition: 1 of selection_*
falsepositives:
    - Administration scripts
level: low