Firewall Configuration Discovery Via Netsh.EXE

Title: Firewall Configuration Discovery Via Netsh.EXE
Status: test
Description:Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules
  -https://ss64.com/nt/netsh.html
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2021-12-07
modified:2025-10-18
Tags:

• -'attack.discovery'
• -'attack.t1016'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\netsh.exe' OriginalFileName:'netsh.exe'   selection_cli:
    CommandLine|contains|all:
      -'netsh'
      -'show '
      -'firewall '

    CommandLine|contains:
      -'config '
      -'state '
      -'rule '
      -'name=all'

  condition:all of selection_*
Falsepositives:
  -Administrative activity
Level: low