{"id":"a35f5a72-f347-4e36-8895-9869b0d5fc6d","title":"Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE","description":"Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall","author":"Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"high","date":"2020-05-25","modified":"2023-12-11","tags":["attack.defense-impairment","attack.t1686.003"],"technique_ids":["T1686.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.virusradar.com/en/Win32_Kasidet.AD/description","https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100"],"source_path":"rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml","source_sha256":"fbafbe5395a6ed7144b4e0b1171fab1837c3bfe7d0dd042c07ac7f472549ea5e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE\nid: a35f5a72-f347-4e36-8895-9869b0d5fc6d\nstatus: test\ndescription: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall\nreferences:\n    - https://www.virusradar.com/en/Win32_Kasidet.AD/description\n    - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100\nauthor: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community\ndate: 2020-05-25\nmodified: 2023-12-11\ntags:\n    - attack.defense-impairment\n    - attack.t1686.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\netsh.exe'\n        - OriginalFileName: 'netsh.exe'\n    selection_cli:\n        - CommandLine|contains|all:\n              - 'firewall'\n              - 'add'\n              - 'allowedprogram'\n        - CommandLine|contains|all:\n              - 'advfirewall'\n              - 'firewall'\n              - 'add'\n              - 'rule'\n              - 'action=allow'\n              - 'program='\n    selection_paths:\n        CommandLine|contains:\n            - ':\\$Recycle.bin\\'\n            - ':\\RECYCLER.BIN\\'\n            - ':\\RECYCLERS.BIN\\'\n            - ':\\SystemVolumeInformation\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Default\\'\n            - ':\\Users\\Desktop\\'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\addins\\'\n            - ':\\Windows\\cursors\\'\n            - ':\\Windows\\debug\\'\n            - ':\\Windows\\drivers\\'\n            - ':\\Windows\\fonts\\'\n            - ':\\Windows\\help\\'\n            - ':\\Windows\\system32\\tasks\\'\n            - ':\\Windows\\Tasks\\'\n            - ':\\Windows\\Temp\\'\n            - '\\Downloads\\'\n            - '\\Local Settings\\Temporary Internet Files\\'\n            - '\\Temporary Internet Files\\Content.Outlook\\'\n            - '%Public%\\'\n            - '%TEMP%'\n            - '%TMP%'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1686.003","id":"T1686.003","name":"Windows Host Firewall","page":"techniques/enterprise/T1686.003/"}],"data_path":"data/detection-rules/a35f5a72-f347-4e36-8895-9869b0d5fc6d.json","kind":"sigma"}