mdecrevoisier high experimental sigma

Firewall deactivation (deprecated command)

Detects scenarios where an attacker disabled the Windows Firewall to evade defense.

View Source

Detection Logic

{
  "selection_event": {
    "EventID": 4688,
    "NewProcessName
| endswith": "\\netsh.exe"
  },
  "selection_command": {
    "Commandline
| contains
| all": [
      "firewall",
      "set",
      "opmode",
      "disable"
    ]
  },
  "selection_obfuscated": {
    "Commandline
| contains
| all": [
      "netsh",
      " f*",
      " s*",
      " o*",
      " d*"
    ]
  },
  "condition": "selection_event and (selection_command or selection_obfuscated)"
}

False Positives

  • ⚠ Administrator activity

Field Validations

Loading…

Comments (0)

Loading comments...