Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
166 detections
Filters
Last updated
All Time
Detection languages
84
40
19
7
5
Contributors
38
29
19
17
14
Categories
86
62
57
12
11
Platforms
122
31
7
4
3
Products / Services
63
26
17
16
12
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects creation, modification, disabling, or deletion of Windows Firewall rules and profiles using netsh.exe or PowerShell NetSecurity cmdlets. Adversaries tamper with the host firewall to disable defenses, open inbound or outbound paths for tools and C2, or remove blocking rules. This is common in hands-on-keyboard intrusions and ransomware staging. The query matches on file name and original file name to catch renamed binaries, covers both modern (advfirewall) and legacy (netsh firewall) syntax, and labels each event with the action performed to speed up triage.
The SAP FTP server allowlist was empty or populated with wildcard entries
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE).
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
Detects the use of the Windows 'netsh.exe' utility to perform network port proxying or tracing configurations, initiated by common command-line shells (cmd.exe, powershell.exe). Attackers may use these capabilities for lateral movement, persistence, or to sniff network traffic.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
This rule detects command-line executions that attempt to disable Windows Defender or the Windows Firewall. It specifically looks for process creation events (EventID 4688) where the command line contains keywords like 'disable' along with 'defender' or 'firewall', executed via PowerShell or cmd. This activity is indicative of an adversary attempting to impair defenses.
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
This rule detects multiple executions of 'netsh firewall' commands within a one-hour window on a single computer. This activity can indicate an adversary attempting to modify or disable system firewalls to bypass security controls, enable C2 communications, or facilitate lateral movement.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects attempts to disable or flush system firewall rules on Linux platforms using common tools like iptables, ufw, firewalld, and nftables. Adversaries often perform these actions to bypass network controls and facilitate unauthorized communication.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.
Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.
Page 1 of 8