[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/12/09"

[rule]
author = ["Elastic"]
description = """
Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to
disable the firewall during troubleshooting or to enable network mobility.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "Disable Windows Firewall Rules via Netsh"
risk_score = 47
rule_id = "4b438734-3793-4fda-bd42-ceeada0be8f9"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Defense Evasion"]
type = "query"

query = '''
event.category:process and event.type:(start or process_started) and
  process.name:netsh.exe and
  process.args:(disable and firewall and set) or process.args:(advfirewall and off and state)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

