Elastic medium stable eql

Enable Host Network Discovery via Netsh

Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
process.name : "netsh.exe" and
process.args : ("firewall", "advfirewall") and process.args : "group=Network Discovery" and process.args : "enable=Yes"

False Positives

  • ⚠ Host Windows Firewall planned system administration changes.

Field Validations

Loading…

Comments (0)

Loading comments...