Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet

Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.

title: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
id: ea207a23-b441-4a17-9f76-ad5be47d51d3
status: test
description: Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
references:
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
date: 2023-07-13
tags:
    - detection.threat-hunting
    - attack.discovery
    - attack.t1518.001
    - attack.t1016
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_payload:
        Payload|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    selection_contextinfo:
        ContextInfo|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    condition: 1 of selection_*
falsepositives:
    - Administration scripts
level: low

• T1016System Network Configuration Discovery
• T1518.001Security Software Discovery

• https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps↗
• https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps↗