Query: rule covering Detects when a rule has been added to the Windows Firewall exception list
Matching passage: Sigma rule: Detects when a rule has been added to the Windows Firewall exception list. Logsource: windows / firewall-as. Rule: title: Uncommon New Firewall Rule Added In Windows Firewall Exception List id: cde0a575-7d3d-4a49-9817-b8004a7bf105 status: test description: Detects when a rule has been added to the Windows Firewall exception list references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2025-10-08 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 filter_main_block: Action: 2 filter_main_generic: ApplicationPath|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_covered_paths: ApplicationPath|contains: - C:\PerfLogs\ - C:\Temp\ - C:\Tmp\ - C:\Users\Public\ - C:\Windows\Tasks\ - C:\Windows\Temp\ - \AppData\Local\Temp\ filter_main_system_dllhost: ApplicationPath: System ModifyingApplication: C:\Windows\System32\dllhost.exe filter_main_tiworker: ModifyingApplication|startswith: C:\Windows\WinSxS\ ModifyingApplication|endswith: \TiWorker.exe filter_main_null: ApplicationPath: null filter_optional_no_path: ModifyingApplication: - C:\Windows\System32\svchost.exe - C:\Windows\System32\dllhost.exe ApplicationPath: '' filter_optional_msmpeng: - ModifyingApplication|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ModifyingApplication|endswith: \MsMpEng.exe - ApplicationPath|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ApplicationPath|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: medium
Near-miss passage: Sigma rule: Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded Invoke Keyword id: 6385697e-9f1b-40bd-8817-f4a91f40508e related: - id: fd6e2919-3936-40c9-99db-0aa922c356f7 type: obsolete status: test description: Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t date: 2022-05-20 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_invoke: CommandLine|contains: - SQBuAHYAbwBrAGUALQ - kAbgB2AG8AawBlAC0A - JAG4AdgBvAGsAZQAtA - SW52b2tlL - ludm9rZS - JbnZva2Ut condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic red team name: Create a Process using WMI Query and an Encoded Command technique: T1047 atomic_guid: 7db7a7f9-9531-4840-9b30-46220135441c regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke/info.yml