Elastic Defend high stable eql

Windows Firewall Exception List Modified via Untrusted Process

Identifies the execution of the built-in Windows program, Netsh, to add a program to the Windows Firewall exception list via an untrusted parent process.

View Source

Detection Logic

sequence with maxspan=1m
  [process where event.action == "start" and
   process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Python*") and not process.code_signature.trusted == true] by process.entity_id
  [process where event.action == "start" and process.name : "netsh.exe" and
   process.command_line : "*add*allowedprogram*ENABLE*" and
   not process.args : ("program=*:\\Program Files\\*", "program=*:\\Program Files (x86)\\*") and
   not (process.args : "name=Free Download Manager" and process.parent.name : "fdm_x64_setup.tmp")
   ] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...