Rule Library

Sigma Rules

1 rule found for "Fatih Sirin"

3,707Total

3,116Detection

451Emerging

137Hunting

Filters

Type

Severity

Status

Product

Category

Detectionmediumtest

Firewall Disabled via Netsh.EXE

Detects netsh commands that turns off the Windows firewall

WindowsProcess Creation

TA0005 · Defense EvasionT1562.004 · Disable or Modify System FirewallS0108 · S0108

Fatih SirinFri Nov 01windows