Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Windows Firewall Profile Disabled

Detects when a user disables the Windows Firewall via a Profile to help evade defense.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Austin SongerCreated Tue Oct 12Updated Fri Dec 30488b44e7-3781-4a71-888d-c95abfacf44dwindows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic2 selectors
detection:
    selection_args:
        ScriptBlockText|contains|all:
            - 'Set-NetFirewallProfile '
            - ' -Enabled '
            - ' False'
    selection_opt:
        ScriptBlockText|contains:
            - ' -All '
            - 'Public'
            - 'Domain'
            - 'Private'
    condition: all of selection*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
learn.microsoft.com
2
Resolving title…
tutorialspoint.com
3
Resolving title…
web.archive.org
4
Resolving title…
woshub.com
5
Resolving title…
elastic.co
MITRE ATT&CK
Related Rules
SimilarDetectionmedium

Windows Firewall Disabled via PowerShell

Detects attempts to disable the Windows Firewall using PowerShell

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
488b44e7-3781-4a71-888d-c95abfacf44d
Status
test
Level
medium
Type
Detection
Created
Tue Oct 12
Modified
Fri Dec 30
Author
Austin Songer
Path
rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml
Raw Tags
attack.defense-evasionattack.t1562.004
View on GitHub