Windows host firewall profile disabled from the command line

Siemphony@siemphonyhighT1686.003unverified

Matches a command line that names a Windows Defender Firewall management surface and, in the same invocation, the argument that turns a profile off or opens its default inbound policy — the firewall-management execution half of MITRE's AN2043. Both predicates run on CommandLine so the rule catches the action whether it is netsh, the NetSecurity PowerShell module, or either of them wrapped in a shell, since the wrapper's own command line carries the same text. Scope is deliberately narrowed to profile-level disablement: adding and modifying individual rules is equally part of the technique but is what every software installer does, and folding it in here would bury the signal. The service-stop and registry-mutation paths the analytic also lists are separate log sources in the brief and are not attempted here. Prerequisite: on the Security EventID 4688 feed this needs the Audit Process Creation subcategory *and* the separate "Include command line in process creation events" policy — neither is on by default, and without the second one CommandLine arrives empty and this rule, which reads nothing else, matches nothing while appearing healthy. MITRE's AuthorizedAdminAccounts and MaintenanceWindow knobs are suppression inputs a single-event rule cannot apply and have to be handled in the SIEM. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0901, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "advfirewall" or ProcessCommandLine contains "netsh firewall" or ProcessCommandLine contains "NetFirewallProfile") and (ProcessCommandLine contains "state off" or ProcessCommandLine contains "opmode disable" or ProcessCommandLine contains "opmode mode=disable" or ProcessCommandLine contains "firewallpolicy allowinbound" or ProcessCommandLine contains "Enabled False" or ProcessCommandLine contains "Enabled:False" or ProcessCommandLine contains "Enabled $false" or ProcessCommandLine contains "Enabled:$false" or ProcessCommandLine contains "DefaultInboundAction Allow"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*advfirewall*" OR CommandLine="*netsh firewall*" OR CommandLine="*NetFirewallProfile*") AND (CommandLine="*state off*" OR CommandLine="*opmode disable*" OR CommandLine="*opmode mode=disable*" OR CommandLine="*firewallpolicy allowinbound*" OR CommandLine="*Enabled False*" OR CommandLine="*Enabled:False*" OR CommandLine="*Enabled $false*" OR CommandLine="*Enabled:$false*" OR CommandLine="*DefaultInboundAction Allow*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*advfirewall*" OR TO_LOWER(process.command_line) LIKE "*netsh firewall*" OR TO_LOWER(process.command_line) LIKE "*netfirewallprofile*") AND (TO_LOWER(process.command_line) LIKE "*state off*" OR TO_LOWER(process.command_line) LIKE "*opmode disable*" OR TO_LOWER(process.command_line) LIKE "*opmode mode=disable*" OR TO_LOWER(process.command_line) LIKE "*firewallpolicy allowinbound*" OR TO_LOWER(process.command_line) LIKE "*enabled false*" OR TO_LOWER(process.command_line) LIKE "*enabled:false*" OR TO_LOWER(process.command_line) LIKE "*enabled $false*" OR TO_LOWER(process.command_line) LIKE "*enabled:$false*" OR TO_LOWER(process.command_line) LIKE "*defaultinboundaction allow*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(advfirewall|netsh firewall|NetFirewallProfile)</field>    <field name="CommandLine" type="pcre2">(?i)(state off|opmode disable|opmode mode=disable|firewallpolicy allowinbound|Enabled False|Enabled:False|Enabled \$false|Enabled:\$false|DefaultInboundAction Allow)</field>    <description>Windows host firewall profile disabled from the command line</description>    <mitre>      <id>T1686.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: defense_evasion_disable_tools
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 966cc04e-0239-4867-948d-e46630a0e3fe

ATT&CKT1686.003

T1686.003Windows Host Firewall

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion disable tools

defense evasion disable toolsAI draft — unreviewed

01 · What this rule detects

A command line that names a Windows Defender Firewall management surface and, in the same invocation, the argument that turns a profile off or opens its default inbound policy. Scope is deliberately profile-level: adding or modifying individual rules is equally part of the technique, but it is also what every installer does, and folding it in would bury the signal.

02 · Telemetry you need

Process creation with arguments. On the brief's Security 4688 feed that

03 · How the logic works

Scope terms cover three surfaces: modern netsh advfirewall, the legacy netsh firewall context, and the NetSecurity PowerShell module. Disable terms cover each surface's phrasing, including four spellings of -Enabled $false because the space, the colon and the $ vary with how it was typed. Tag check worth noticing. ATT&CK v19 moved this technique into a defense-impairment tactic, but the tag reads attack.defense-evasion, taken from the brief's sigmaTactics rather than its tactics. Sigma's vocabulary has no defense-impairment; the MITRE-true value would resolve to nothing. The dead arm — the main lesson here. netsh firewall is matched as a two-word string, which only survives when the binary is typed with no extension and no path. netsh.exe firewall set opmode disable, or a full-path invocation, contains netsh.exe firewall — not netsh firewall. Those are the forms scheduled tasks, WMI, PsExec and most scripts produce, so the entire legacy arm, and with it opmode disable and opmode mode=disable, never fires. Why it survived authoring is the part to internalise: advfirewall is a standalone token that appears however the binary was written, so that arm has no such problem, and testing with netsh advfirewall set allprofiles state off works perfectly. A healthy arm masked a dead one. When a selection block ORs several terms, each needs its own test case — a rule that fires is not evidence that every branch fires. The fix is to key on the subcommand rather than binding the binary name into the string. A related softness. Both predicates run on CommandLine with no Image or parent gate. The description calls this a feature — a shell wrapper's own command line carries the same text, so wrapped invocations are caught. The cost is unstated: any process that merely mentions these strings matches with no firewall touched, and one real action alerts twice (wrapper and child).

04 · Common false positives

Compliance and configuration-management tooling — the reviewer's missed
Imaging, provisioning, and endpoint-protection installers that disable the
Help-desk troubleshooting: profile off, test, profile back on, same account,
Lab and reference images where a startup script disables the firewall on each

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0901 and never executed against a log line. level: high reflects that turning a host firewall off is rarely benign; it is not a measured rate, and with the legacy arm dead the rule's true coverage is narrower than its selection block looks.
tier_2: fix the netsh.exe string, add an Image scoping arm, baseline your configuration-management traffic.
tier_3: is AN2043 as written — the change correlated with the measurable network exposure that follows inside MITRE's ExposureCorrelationWindow, which Sigma cannot reach.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

`AllowedManagementParents` (MITRE's knob) is the highest-leverage
`AuthorizedAdminAccounts` and `MaintenanceWindow` (MITRE's knobs) are
Shorten the scope term to advf: netsh accepts any unambiguous context
Two adjacent one-liners are uncovered and undeclared: `netsh advfirewall

Declared by the author

Imaging and provisioning steps, and third-party endpoint-protection installers that disable the Windows profiles because the suite supplies its own firewall. These arrive as a burst under a management parent such as an SCCM, Intune or GPO client early in a build, which is what MITRE's AllowedManagementParents knob is there to carve out.
Help-desk troubleshooting of a connectivity complaint, where an administrator turns a profile off, tests, and turns it back on within a few minutes under the same account. The disable half of that pair is indistinguishable from the attack in a single event and needs the re-enable to be looked for before escalating.
Lab, test and reference images where the firewall is off by policy and the disabling command runs from a startup script on every boot, producing one match per machine per reboot. Scoping the rule away from those hosts is more reliable than trying to fingerprint the script.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1686.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/966cc04e-0239-4867-948d-e46630a0e3fe

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Windows host firewall profile disabled from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it