New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE — Sigma Rule

Rule metadata and linked tags

Author: frack113, Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2024-05-10 / not supplied.

{
  "product": "windows",
  "service": "firewall-as"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 6fa3df2cba361e0dbbb4514ece330108983191e11bd623c838104ad0d24b8e90

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
id: eca81e8d-09e1-4d04-8614-c91f44fd0519
status: test
description: |
    Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE).
    This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
    - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
    - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2024-05-10
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    product: windows
    service: firewall-as
detection:
    selection:
        EventID:
            - 2004 # A rule has been added to the Windows Defender Firewall exception list
            - 2071 # A rule has been added to the Windows Defender Firewall exception list. (Windows 11)
            - 2097
        Action: 3 # Allow
        ModifyingApplication|endswith: ':\Windows\System32\wbem\WmiPrvSE.exe'
    condition: selection
falsepositives:
    - Administrator scripts or activity.
level: medium

Original YAML and metadata in JSON

False positives

• Administrator scripts or activity.

Source references

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
• https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
• https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/