Firewall Disabled via Netsh.EXE

Title: Firewall Disabled via Netsh.EXE
Status: test
Description:Detects netsh commands that turns off the Windows firewall
References:
  -https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
  -https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall
Author: Fatih Sirin
Date: 2019-11-01
modified:2023-02-13
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'
• -'attack.s0108'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\netsh.exe' OriginalFileName:'netsh.exe'   selection_cli_1:
    CommandLine|contains|all:
      -'firewall'
      -'set'
      -'opmode'
      -'disable'

  selection_cli_2:
    CommandLine|contains|all:
      -'advfirewall'
      -'set'
      -'state'
      -'off'

  condition:selection_img and 1 of selection_cli_*
Falsepositives:
  -Legitimate administration activity
Level: medium