Host firewall disabled or opened from a command line

Siemphony@siemphonylowT1686unverified

AN0406 names three Windows firewall-tampering behaviours — netsh, the PowerShell Set-NetFirewallProfile cmdlet, and stopping the mpssvc service — and this rule is those three plus the reg.exe spelling of the registry leg the same analytic describes. The netsh arm is split in two because disabling and opening are different acts with different noise: turning a profile off matches the switch text itself (`state off`, the legacy `set opmode disable`, and `advfirewall reset`, which restores the default policy and silently discards every rule an estate had added), while punching a hole requires both `firewall add rule` and `action=allow` on the same line, so a rule addition that only blocks does not match. The cmdlet arm matches the four NetSecurity verbs an adversary would reach for; it deliberately does not try to tell the disabling direction from the enabling one, because `-Enabled False`, `-Enabled:$false` and `-Enabled 0` are all valid spellings and a selector pinned to one of them would look tighter while quietly missing the other two. The service arm gates on the image being sc.exe, net.exe or net1.exe — net.exe re-executes itself as net1.exe, so either can be the logged image — together with the mpssvc service name, which covers `sc stop mpssvc` and the more durable `sc config mpssvc start= disabled` in one selection. MITRE's `MonitoredCommands` knob is what the image and verb lists implement, populated here from the analytic's prose rather than taken from MITRE; its `AlertThreshold` knob — alert only after N firewall changes in a window — is a count over time, which lib/sigma models with neither an aggregation nor a timeframe, so nothing here encodes it and the rule fires on the single event. Vocabulary and limits. AN0406 gives Security EventID 4688 for this leg and the brief maps it onto the Sigma `process_creation` category, which is Sysmon-EventID-1-shaped; this rule is written in that vocabulary (`Image`, `CommandLine`), so an estate feeding raw 4688 needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines, and without them this rule returns zero rows, which reads as quiet when it means blind. The analytic's registry legs (Sysmon EventID 13 and 14 on `registry_set` and `registry_rename`) are a different logsource and are not authored here; the only part of them visible from process creation is a command line naming both the FirewallPolicy key and the `EnableFirewall` value, which catches reg.exe and the PowerShell `HKLM:\SYSTEM\...` path form of the profile switch-off. Requiring the value name alongside the key is what keeps that selection to the modification the analytic describes rather than any mention of the key, but it also means writes under the `FirewallRules` subkey are not covered there — the netsh and cmdlet arms are what carry rule addition. Nothing in this rule sees an implant calling RegSetValueEx directly, `regedit /s policy.reg` (the key lives inside the file), or the Group Policy and MDM paths that set the same values through their own service. The Linux arm AN0407 (iptables, nft, firewall-cmd) and the macOS arm AN0408 (pfctl, socketfilterfw) are separate log sources; AN0408's `macos/unifiedlog` has no standardised Sigma field vocabulary in this corpus, so its fields would have to be invented. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0145, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\netsh.exe" and (ProcessCommandLine contains "state off" or ProcessCommandLine contains "set opmode disable" or ProcessCommandLine contains "advfirewall reset")) or (FolderPath endswith "\\netsh.exe" and (ProcessCommandLine contains "firewall add rule" and ProcessCommandLine contains "action=allow")) or (ProcessCommandLine contains "Set-NetFirewallProfile" or ProcessCommandLine contains "New-NetFirewallRule" or ProcessCommandLine contains "Disable-NetFirewallRule" or ProcessCommandLine contains "Remove-NetFirewallRule") or ((FolderPath endswith "\\sc.exe" or FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains "mpssvc") or (ProcessCommandLine contains "SharedAccess\\Parameters\\FirewallPolicy" and ProcessCommandLine contains "EnableFirewall"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\netsh.exe" AND (CommandLine="*state off*" OR CommandLine="*set opmode disable*" OR CommandLine="*advfirewall reset*")) OR (Image="*\\netsh.exe" AND (CommandLine="*firewall add rule*" AND CommandLine="*action=allow*")) OR (CommandLine="*Set-NetFirewallProfile*" OR CommandLine="*New-NetFirewallRule*" OR CommandLine="*Disable-NetFirewallRule*" OR CommandLine="*Remove-NetFirewallRule*") OR ((Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="*mpssvc*") OR (CommandLine="*SharedAccess\\Parameters\\FirewallPolicy*" AND CommandLine="*EnableFirewall*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\netsh.exe" AND (TO_LOWER(process.command_line) LIKE "*state off*" OR TO_LOWER(process.command_line) LIKE "*set opmode disable*" OR TO_LOWER(process.command_line) LIKE "*advfirewall reset*")) OR (TO_LOWER(process.executable) LIKE "*\\\\netsh.exe" AND (TO_LOWER(process.command_line) LIKE "*firewall add rule*" AND TO_LOWER(process.command_line) LIKE "*action=allow*")) OR (TO_LOWER(process.command_line) LIKE "*set-netfirewallprofile*" OR TO_LOWER(process.command_line) LIKE "*new-netfirewallrule*" OR TO_LOWER(process.command_line) LIKE "*disable-netfirewallrule*" OR TO_LOWER(process.command_line) LIKE "*remove-netfirewallrule*") OR ((TO_LOWER(process.executable) LIKE "*\\\\sc.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "*mpssvc*") OR (TO_LOWER(process.command_line) LIKE "*sharedaccess\\\\parameters\\\\firewallpolicy*" AND TO_LOWER(process.command_line) LIKE "*enablefirewall*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 5 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\netsh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(state off|set opmode disable|advfirewall reset)</field>    <description>Host firewall disabled or opened from a command line (1/5)</description>    <mitre>      <id>T1686</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\netsh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:firewall add rule))(?=.*(?:action=allow)).*</field>    <description>Host firewall disabled or opened from a command line (2/5)</description>    <mitre>      <id>T1686</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Set-NetFirewallProfile|New-NetFirewallRule|Disable-NetFirewallRule|Remove-NetFirewallRule)</field>    <description>Host firewall disabled or opened from a command line (3/5)</description>    <mitre>      <id>T1686</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\sc\.exe$|\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)mpssvc</field>    <description>Host firewall disabled or opened from a command line (4/5)</description>    <mitre>      <id>T1686</id>    </mitre>  </rule>   <rule id="100004" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:SharedAccess\\Parameters\\FirewallPolicy))(?=.*(?:EnableFirewall)).*</field>    <description>Host firewall disabled or opened from a command line (5/5)</description>    <mitre>      <id>T1686</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: defense_evasion_disable_tools
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9236d0be-d5a6-4e45-885a-7825b918cc4d

ATT&CKT1686

T1686Disable or Modify System Firewall

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion disable tools

defense evasion disable toolsAI draft — unreviewed

01 · What this rule detects

Five ways a Windows host firewall gets stood down or opened from a command line: netsh turning a profile off, netsh punching an allow hole, the NetSecurity PowerShell cmdlets, stopping or disabling the mpssvc service, and reg.exe writing the FirewallPolicy value. It is a command-line rule only — it sees the tool, not the setting. RegSetValueEx, the firewall COM API, regedit /s with the key inside the file, and Group Policy or MDM pushing the same values all produce no match.

02 · Telemetry you need

Sigma process_creation / windows, from AN0406's Security 4688 entry. That category is Sysmon-EventID-1-shaped, and the rule is written in that vocabulary (Image, CommandLine), so raw 4688 needs NewProcessName mapped onto Image first. 4688 also needs Audit Process Creation plus the separate Include command line in process creation events policy before CommandLine exists — neither is on by default or in the Microsoft and CIS baselines, and without them the rule returns zero rows, which reads as quiet when it means blind. AN0406's registry legs (Sysmon 13/14) and the Linux and macOS analytics are other logsources and are not authored here.

03 · How the logic works

selection_netsh_disable pins Image|endswith '\netsh.exe' and matches the switch text itself: state off, the legacy set opmode disable, and advfirewall reset, which restores default policy and silently discards every rule the estate had added. selection_netsh_allow_rule is separate because opening is a different act with different noise — it needs firewall add rule and action=allow on the same line, so a purely blocking rule addition does not match. selection_netsecurity_cmdlet matches four cmdlet names anywhere on a line; it does not try to tell the disabling direction from the enabling one, because -Enabled False, -Enabled:$false and -Enabled 0 are all valid and a selector pinned to one would look tighter while missing two. selection_mpssvc_service gates sc.exe, net.exe and net1.exe (net re-executes itself as net1, so either can be logged) against the string mpssvc, covering sc stop and the more durable sc config mpssvc start= disabled. selection_firewallpolicy_key requires both the FirewallPolicy key path and the EnableFirewall value name, keeping it to modification rather than any mention of the key. Condition is 1 of selection*. MITRE's MonitoredCommands knob is what the image and verb lists implement — the values are the pipeline's own, read from the analytic's prose. Its AlertThreshold knob (alert after N changes in a window) is a count over time, which lib/sigma models with neither aggregation nor timeframe, so nothing here encodes it and the rule fires on a single event.

04 · Common false positives

Loudest by a wide margin is software installation: MSI custom actions and setup scripts opening their own ports with netsh advfirewall firewall add rule ... action=allow or New-NetFirewallRule, on every install, repair and upgrade. That is why the level is low, not medium — a level that contradicts its own top false positive is the standard calibration failure here. Next is config management: Ansible, DSC, Chef, Puppet and Intune reapply firewall policy on every convergence run whether or not anything changed. Then service desk work (state off to prove the firewall is the cause) and deliberate enablement of WinRM, RDP or an RMM agent during build and bootstrap. The registry arm also matches reads: reg query of that key with /v EnableFirewall satisfies both terms, so compliance scanners look identical to a switch-off.

05 · Detection maturity

tier_1: Lowest tier. Never executed against a log line, so it has no measured hit rate and no evidence it fires on the technique. It rises only once someone runs the commands in a lab, confirms CommandLine is populated, and measures real volume.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress by parent and account, not by tool. Install and convergence noise is best cut on ParentImage (msiexec.exe, the agent binary) and on the service accounts that run it. Two gaps to know rather than tune: the netsh arms cover only modern spellings, so the legacy set opmode mode=disable, add portopening and add allowedprogram slip through; and the cmdlet arm sees only inline -Command invocations — a cmdlet inside a .ps1 body, typed at a console, or -EncodedCommand needs PowerShell 4104 Script Block Logging, a different logsource entirely.

Declared by the author

Software installation. Server products, database engines, hypervisor and backup agents, line-of-business applications and driver packages open their own ports from an MSI custom action or a setup script, almost always with netsh advfirewall firewall add rule action=allow or New-NetFirewallRule. Every install, repair and upgrade across the estate produces a match, this is the highest-volume source here by a wide margin, and it is why the rule is scored low rather than medium.
Configuration management and endpoint tooling reapplying firewall policy on a schedule. Ansible win_firewall_rule, DSC, Chef, Puppet, Configuration Manager compliance baselines and Intune remediation scripts call New-NetFirewallRule and Set-NetFirewallProfile on every convergence run whether or not the resulting policy actually changed, from a service account, on every host in scope.
Service desk troubleshooting a connectivity problem. Turning a profile off with netsh advfirewall set allprofiles state off to prove the firewall is the cause, or stopping mpssvc for the same reason, is ordinary first-line work and emits an event indistinguishable from the adversary's.
Remote administration and monitoring being enabled on purpose. Turning on WinRM, RDP, SQL Browser, file and printer sharing or an RMM agent through their documented setup steps adds an allow rule for the port, and the same commands appear in image build, cloud instance bootstrap and Packer provisioning output for every machine built.
Third-party endpoint security products taking over the host firewall. Their installers disable the Windows Defender Firewall profiles or reset the policy so their own filtering driver owns the traffic, which produces exactly the netsh disable and mpssvc events this rule selects.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-netsh-firewall-rule
Group Policy or an installer opening a port for a line-of-business application.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1686, evaluated against their process_creation events.

Share this rule

/u/siemphony/9236d0be-d5a6-4e45-885a-7825b918cc4d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@nadia-brandt
19 Aug 2026
Ran this across 30 days of our estate and got a little over 2,400 hits. All but six were New-NetFirewallRule from Intune remediation converging on the same handful of hosts. Scoring it low is correct, but I would go further in the description: the detection value is almost entirely in the `state off` / `advfirewall reset` arm. The `firewall add rule` + `action=allow` arm is a software inventory feed wearing a detection's clothes.
- @owen-mackay
  19 Aug 2026
  Same shape here, and we ended up splitting it into two rules rather than tuning one. The disable arm is medium and pages; the add-rule arm is informational and feeds a hunt dashboard. A single rule carrying two different levels of truth never survives contact with a triage queue — someone eventually mutes the whole thing to get rid of the loud half.

Host firewall disabled or opened from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread