LoFP / host windows firewall planned system administration changes.

Techniques

• T1562

Sample rules

Enable Host Network Discovery via Netsh

• source: elastic
• technicques:
  • T1562

Description

Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings.

Detection logic

process where host.os.type == "windows" and event.type == "start" and
process.name : "netsh.exe" and
process.args : ("firewall", "advfirewall") and process.args : "group=Network Discovery" and process.args : "enable=Yes"