Windows Firewall Profile Disabled

Title: Windows Firewall Profile Disabled
Status: test
Description:Detects when a user disables the Windows Firewall via a Profile to help evade defense.
References:
  -https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps
  -https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
  -https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
  -http://woshub.com/manage-windows-firewall-powershell/
  -https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html
Author: Austin Songer @austinsonger
Date: 2021-10-12
modified:2022-12-30
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_args:
    ScriptBlockText|contains|all:
      -'Set-NetFirewallProfile '
      -' -Enabled '
      -' False'

  selection_opt:
    ScriptBlockText|contains:
      -' -All '
      -'Public'
      -'Domain'
      -'Private'

  condition:all of selection*
Falsepositives:
  -Unknown
Level: medium