Windows Firewall Rule Deletion via Netsh.exe

Adversaries and malicious software frequently leverage the legitimate Windows command-line utility 'netsh.exe' to modify network security configurations. By executing specific commands, actors can delete firewall port or application rules, thereby disabling critical defense mechanisms. This activity is typically observed during the post-exploitation phase, where an attacker seeks to bypass restrictive network segmentation or security policies to establish persistence or enable C2 traffic. Defenders should distinguish between legitimate administrative maintenance, software updates, and unauthorized modifications initiated by non-standard parent processes.

Attack Chain

1. Attacker gains initial access or code execution on the target Windows system.
2. Attacker performs internal reconnaissance to identify existing firewall rules.
3. Attacker determines a need to disable security filters for a specific port or service.
4. Attacker executes 'netsh.exe' with elevated privileges to modify the Windows Firewall configuration.
5. The command 'netsh firewall delete' or 'netsh advfirewall firewall delete' is issued against specific rules.
6. The Windows Firewall removes the specified rule, creating an open hole in network ingress/egress filtering.
7. Attacker proceeds with malicious objectives, such as lateral movement or exfiltration, unimpeded by previous security rules.

Impact

Successful deletion of firewall rules impairs host-based security, increasing the probability of successful exploitation, lateral movement, or data exfiltration. If left unmonitored, this activity allows adversaries to maintain long-term access and control within the target network segment.

Recommendation

• Deploy the provided Sigma rule to monitor process creation events for 'netsh.exe' command-line arguments related to firewall rule deletion.
• Baseline common administrative scripts or software installation processes that frequently modify firewall rules to reduce false positives in the detection logic.
• Enable PowerShell script block logging and process creation (Event ID 1) for visibility into administrative tool execution.
• Audit and restrict administrative access to systems where modification of firewall settings is not required by standard business operations.