{"id":"eca81e8d-09e1-4d04-8614-c91f44fd0519","title":"New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE","description":"Detects the addition of a new \"Allow\" firewall rule by the WMI process (WmiPrvSE.EXE).\nThis can occur if an attacker leverages PowerShell cmdlets such as \"New-NetFirewallRule\", or directly uses WMI CIM classes such as \"MSFT_NetFirewallRule\".\n","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-05-10","modified":"","tags":["attack.defense-impairment","attack.t1686.003"],"technique_ids":["T1686.003"],"logsource":{"product":"windows","service":"firewall-as"},"falsepositives":["Administrator scripts or activity."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule","https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170","https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/"],"source_path":"rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml","source_sha256":"6fa3df2cba361e0dbbb4514ece330108983191e11bd623c838104ad0d24b8e90","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE\nid: eca81e8d-09e1-4d04-8614-c91f44fd0519\nstatus: test\ndescription: |\n    Detects the addition of a new \"Allow\" firewall rule by the WMI process (WmiPrvSE.EXE).\n    This can occur if an attacker leverages PowerShell cmdlets such as \"New-NetFirewallRule\", or directly uses WMI CIM classes such as \"MSFT_NetFirewallRule\".\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule\n    - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170\n    - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-05-10\ntags:\n    - attack.defense-impairment\n    - attack.t1686.003\nlogsource:\n    product: windows\n    service: firewall-as\ndetection:\n    selection:\n        EventID:\n            - 2004 # A rule has been added to the Windows Defender Firewall exception list\n            - 2071 # A rule has been added to the Windows Defender Firewall exception list. (Windows 11)\n            - 2097\n        Action: 3 # Allow\n        ModifyingApplication|endswith: ':\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n    condition: selection\nfalsepositives:\n    - Administrator scripts or activity.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1686.003","id":"T1686.003","name":"Windows Host Firewall","page":"techniques/enterprise/T1686.003/"}],"data_path":"data/detection-rules/eca81e8d-09e1-4d04-8614-c91f44fd0519.json","kind":"sigma"}