New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Title: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
Status: test
Description:Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
  -https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
  -https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-05-10
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'

Logsource:

• product: windows
• service: firewall-as

Detection:
  selection:
    EventID:
      -'2004'
      -'2071'
      -'2097'

    Action: '3'
    ModifyingApplication|endswith: ':\Windows\System32\wbem\WmiPrvSE.exe'
  condition:selection
Falsepositives:
  -Administrator scripts or activity.
Level: medium