upStage Proxyware Firewall Rule Modification
Detects the use of netsh.exe to create firewall rules that allow traffic for the upStage proxyware binaries (hero.exe, Uphero.exe) or specific non-standard ports (1000, 1002) used for proxy traffic. This behavior is a key step for the malware to ensure its network communication is not blocked. // False Positives: Medium. While the file names are specific, rules created for ports 1000 or 1002 could potentially be legitimate for other applications. Review the initiating process and rule details to confirm maliciousness.
Microsoft Sentinel (KQL)
