List Local Firewall Additions
Local Firewall Additions
Query
DeviceProcessEvents
| where ProcessCommandLine has "firewall add"
| where InitiatingProcessFileName != "Microsoft.Tri.Sensor.Updater.exe" // DFI sensor
| project-reorder
Timestamp,
DeviceName,
AccountName,
ProcessCommandLine,
InitiatingProcessCommandLineAbout this query
List Local Firewall Additions
Query Information
Description
List Local Firewall Additions
Defender XDR
Sentinel
DeviceProcessEvents
| where ProcessCommandLine has "firewall add"
| where InitiatingProcessFileName != "Microsoft.Tri.Sensor.Updater.exe" // DFI sensor
| project-reorder
TimeGenerated,
DeviceName,
AccountName,
ProcessCommandLine,
InitiatingProcessCommandLine
Explanation
This query is designed to identify and list instances where local firewall rules have been added on devices. It specifically looks for processes that include the term "firewall add" in their command line, which indicates an attempt to modify firewall settings. The query excludes any additions initiated by a specific system process called "Microsoft.Tri.Sensor.Updater.exe," which is likely a legitimate process related to a security sensor.
The query retrieves and organizes the following details for each relevant event:
- Timestamp/TimeGenerated: The date and time when the event occurred.
- DeviceName: The name of the device where the firewall rule was added.
- AccountName: The user account that initiated the process.
- ProcessCommandLine: The full command line of the process that attempted to add a firewall rule.
- InitiatingProcessCommandLine: The command line of the process that started the process adding the firewall rule.
The query is applicable to both Defender XDR and Sentinel environments, with slight differences in the timestamp field name.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators