Firewall Configuration Discovery Via Netsh.EXE

testlow
Log-Quelle: windows · process_creationAutor frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'Datum 2021-12-07
01

Beschreibung

Was dies ist, in Kürze.

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

02

Tags

attack.discoveryattack.t1016
03

Regelquelle (YAML)

title: Firewall Configuration Discovery Via Netsh.EXE
id: 0e4164da-94bc-450d-a7be-a4b176179f1f
status: test
description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules
    - https://ss64.com/nt/netsh.html
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
date: 2021-12-07
modified: 2025-10-18
tags:
    - attack.discovery
    - attack.t1016
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\netsh.exe'
        - OriginalFileName: 'netsh.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'netsh'
            - 'show '
            - 'firewall '
        CommandLine|contains:
            - 'config '
            - 'state '
            - 'rule '
            - 'name=all'
    condition: all of selection_*
falsepositives:
    - Administrative activity
level: low
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.