New Firewall Rule Added Via Netsh.EXE

Title: New Firewall Rule Added Via Netsh.EXE
Status: test
Description:Detects the addition of a new rule to the Windows firewall via netsh
References:
  -https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
Author: Markus Neis, Sander Wiebing
Date: 2019-01-29
modified:2023-02-10
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'
• -'attack.s0246'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\netsh.exe' OriginalFileName:'netsh.exe'   selection_cli:
    CommandLine|contains|all:
      -' firewall '
      -' add '

  filter_optional_dropbox:
    CommandLine|contains:
      -'advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any'
      -'advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files\Dropbox\Client\Dropbox.exe" enable=yes profile=Any'

  condition:all of selection_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate administration activity
  -Software installations
Level: medium