Host firewall disabled or opened from a command line

1title: Host firewall disabled or opened from a command line2id: 9236d0be-d5a6-4e45-885a-7825b918cc4d3status: experimental4description: |5  AN0406 names three Windows firewall-tampering behaviours — netsh, the6  PowerShell Set-NetFirewallProfile cmdlet, and stopping the mpssvc service —7  and this rule is those three plus the reg.exe spelling of the registry leg the8  same analytic describes. The netsh arm is split in two because disabling and9  opening are different acts with different noise: turning a profile off matches10  the switch text itself (`state off`, the legacy `set opmode disable`, and11  `advfirewall reset`, which restores the default policy and silently discards12  every rule an estate had added), while punching a hole requires both13  `firewall add rule` and `action=allow` on the same line, so a rule addition14  that only blocks does not match. The cmdlet arm matches the four15  NetSecurity verbs an adversary would reach for; it deliberately does not try to16  tell the disabling direction from the enabling one, because `-Enabled False`,17  `-Enabled:$false` and `-Enabled 0` are all valid spellings and a selector18  pinned to one of them would look tighter while quietly missing the other two.19  The service arm gates on the image being sc.exe, net.exe or net1.exe — net.exe20  re-executes itself as net1.exe, so either can be the logged image — together21  with the mpssvc service name, which covers `sc stop mpssvc` and the more22  durable `sc config mpssvc start= disabled` in one selection. MITRE's23  `MonitoredCommands` knob is what the image and verb lists implement, populated24  here from the analytic's prose rather than taken from MITRE; its25  `AlertThreshold` knob — alert only after N firewall changes in a window — is a26  count over time, which lib/sigma models with neither an aggregation nor a27  timeframe, so nothing here encodes it and the rule fires on the single event.28  Vocabulary and limits. AN0406 gives Security EventID 4688 for this leg and the29  brief maps it onto the Sigma `process_creation` category, which is30  Sysmon-EventID-1-shaped; this rule is written in that vocabulary (`Image`,31  `CommandLine`), so an estate feeding raw 4688 needs `NewProcessName` mapped32  onto `Image` first, and 4688 needs both *Audit Process Creation* and the33  separate *Include command line in process creation events* policy before34  `CommandLine` exists at all — neither is on in a default install or in the35  Microsoft and CIS baselines, and without them this rule returns zero rows,36  which reads as quiet when it means blind. The analytic's registry legs (Sysmon37  EventID 13 and 14 on `registry_set` and `registry_rename`) are a different38  logsource and are not authored here; the only part of them visible from process39  creation is a command line naming both the FirewallPolicy key and the40  `EnableFirewall` value, which catches reg.exe and the PowerShell41  `HKLM:\SYSTEM\...` path form of the profile switch-off. Requiring the value42  name alongside the key is what keeps that selection to the modification the43  analytic describes rather than any mention of the key, but it also means writes44  under the `FirewallRules` subkey are not covered there — the netsh and cmdlet45  arms are what carry rule addition. Nothing in this rule sees an implant calling46  RegSetValueEx directly, `regedit /s policy.reg` (the key lives inside the47  file), or the Group Policy and MDM paths that set the same values through48  their own service. The Linux arm AN0407 (iptables, nft, firewall-cmd) and the49  macOS arm AN0408 (pfctl, socketfilterfw) are separate log sources; AN0408's50  `macos/unifiedlog` has no standardised Sigma field vocabulary in this corpus,51  so its fields would have to be invented.52  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0145, not hand-written and not tested by its author. Any lab result is on this rule's own page.53references:54  - https://attack.mitre.org/techniques/T168655  - https://attack.mitre.org/detectionstrategies/DET014556author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)57date: 2026-08-1758tags:59  - attack.defense-evasion60  - attack.t168661logsource:62  category: process_creation63  product: windows64detection:65  selection_netsh_disable:66    Image|endswith: '\netsh.exe'67    CommandLine|contains:68      - 'state off'69      - 'set opmode disable'70      - 'advfirewall reset'71  selection_netsh_allow_rule:72    Image|endswith: '\netsh.exe'73    CommandLine|contains|all:74      - 'firewall add rule'75      - 'action=allow'76  selection_netsecurity_cmdlet:77    CommandLine|contains:78      - 'Set-NetFirewallProfile'79      - 'New-NetFirewallRule'80      - 'Disable-NetFirewallRule'81      - 'Remove-NetFirewallRule'82  selection_mpssvc_service:83    Image|endswith:84      - '\sc.exe'85      - '\net.exe'86      - '\net1.exe'87    CommandLine|contains: 'mpssvc'88  selection_firewallpolicy_key:89    CommandLine|contains|all:90      - 'SharedAccess\\Parameters\\FirewallPolicy'91      - 'EnableFirewall'92  condition: 1 of selection*93falsepositives:94  - "Software installation. Server products, database engines, hypervisor and backup agents, line-of-business applications and driver packages open their own ports from an MSI custom action or a setup script, almost always with netsh advfirewall firewall add rule action=allow or New-NetFirewallRule. Every install, repair and upgrade across the estate produces a match, this is the highest-volume source here by a wide margin, and it is why the rule is scored low rather than medium."95  - "Configuration management and endpoint tooling reapplying firewall policy on a schedule. Ansible win_firewall_rule, DSC, Chef, Puppet, Configuration Manager compliance baselines and Intune remediation scripts call New-NetFirewallRule and Set-NetFirewallProfile on every convergence run whether or not the resulting policy actually changed, from a service account, on every host in scope."96  - "Service desk troubleshooting a connectivity problem. Turning a profile off with netsh advfirewall set allprofiles state off to prove the firewall is the cause, or stopping mpssvc for the same reason, is ordinary first-line work and emits an event indistinguishable from the adversary's."97  - "Remote administration and monitoring being enabled on purpose. Turning on WinRM, RDP, SQL Browser, file and printer sharing or an RMM agent through their documented setup steps adds an allow rule for the port, and the same commands appear in image build, cloud instance bootstrap and Packer provisioning output for every machine built."98  - "Third-party endpoint security products taking over the host firewall. Their installers disable the Windows Defender Firewall profiles or reset the policy so their own filtering driver owns the traffic, which produces exactly the netsh disable and mpssvc events this rule selects."99level: low