Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
22
12
8
6
3
Contributors
16
13
9
4
3
Categories
41
32
19
6
5
Platforms
54
Products / Services
22
21
16
8
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
The following analytic identifies the use of netsh.exe to configure a connection proxy, which can be leveraged for persistence by executing a helper DLL. It detects this activity by analyzing process creation events from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "portproxy" and "v4tov4" parameters. This activity is significant because it indicates potential unauthorized network configuration changes, which could be used to maintain persistence or redirect network traffic. If confirmed malicious, this could allow an attacker to maintain covert access or manipulate network communications, posing a significant security risk.
The following analytic detects the execution of the Windows built-in tool netsh.exe to display the state, configuration, and profile of the host firewall. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. Monitoring this activity is crucial as netsh.exe can be used by adversaries to bypass firewall rules or discover firewall settings. If confirmed malicious, this activity could allow attackers to manipulate firewall configurations, potentially leading to unauthorized network access or data exfiltration.
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.
Detects the use of 'netsh.exe' commands to disable the Windows firewall. This includes commands targeting both the legacy 'firewall' context and the 'advfirewall' (Windows Defender Firewall with Advanced Security) context, specifically looking for parameters that set the firewall state to disabled or off.
This rule detects the execution of the 'netsh.exe' utility specifically when it is used to modify existing Windows Advanced Firewall rules. The detection logic looks for 'netsh.exe' being executed with the 'advfirewall' and 'set' options in the command line, indicating an attempt to change properties of an already defined firewall rule. This activity could be indicative of an adversary attempting to bypass network controls to facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of `netsh.exe` commands that modify the Windows Firewall to whitelist a program. Specifically, it looks for `netsh.exe` being executed with arguments to 'add allowedprogram' or 'add rule' with 'action=allow' and 'program=' where the program path is located in suspicious directories such as Recycle Bin, System Volume Information, Temp folders, or various Windows system subdirectories that are not typical locations for legitimate applications requiring firewall exceptions.
Detects the execution of netsh with the "add helper" flag to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy, getting called whenever netsh.exe is executed.
Detects the execution of 'netsh.exe' with the 'trace' and 'start' flags, indicating that a network trace capture has been initiated. This activity can be used by adversaries for network sniffing to gather information about the environment, including credentials or network configurations.
Detects the addition of a new rule to the Windows firewall using the 'netsh.exe' command-line utility. This activity can indicate an adversary attempting to bypass network controls for C2 communications, lateral movement, or data exfiltration.
This rule detects the use of 'netsh.exe' to modify Microsoft Defender Firewall rules. Specifically, it looks for command-line arguments that indicate the setting of a new firewall rule with 'group=' and 'enable=Yes', which could be used by adversaries to bypass network controls.
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Page 3 of 3