False-Negative: Netsh Firewall Discovery With Full Command Path

[BalsamicSentry]

Rule UUID

0e4164da-94bc-450d-a7be-a4b176179f1f

Example EventLog

EventCode=4688 ... Message=A new process has been created. ... Creator Subject: ... Target Subject: ... Process Information: New Process ID: 0xBEEF New Process Name: C:\Windows\System32\netsh.exe Token Elevation Type: %%1234 Mandatory Label: S-1-16-12288 Creator Process ID: 0xDEAD Creator Process Name: C:\Windows\System32\cmd.exe Process Command Line: C:\Windows\System32\netsh.exe advfirewall firewall show rule name=all verbose

Description

I discovered a false negative where suspicious traffic is able to avoid detection. The CLI parameters are too specific and don't allow for ".exe" to be at the end of the string.

[nasbench]

Thanks for reporting. This is indeed an issue with the rule and we'll get it fixed soon.

[swachchhanda000]

Closing as this issue has been addressed.