Spotting the Adversary with Windows Event Log Monitoring

netsh advfirewall firewall set rule name=”Windows Remote Management (HTTP-In)” new
enable=yes
If an error message “A specific value is not valid” appears, verify the rule’s name. The alternative
approach is to enter the netsh context, followed by the advfirewall context, and the firewall context. In
the firewall context, repeat the command for the specific rule.
2.6.2 Source Firewall
When WinRM is executed with the quickconfig option, it creates a default firewall rule that allows
inbound WinRM traffic. The firewall rule automatically sets the required port (80 or 5985) depending on
the WinRM version. Configuring WinRM locally on sources is discouraged as using Group Policy is more
manageable.
2.6.2.1 WinRM 2.0
Sources using WinRM 2.0 require that port 5985 is allowed through the firewall. The predefined rule
Windows Remote Management (HTTP-In) should only be enabled on a computer using WinRM 2.0. The
steps for enabling the firewall rule via GPO for the sources can be done by following the Windows
Firewall with Advanced Security Group Policy section. This rule should be applied to Windows Vista and
beyond as it uses Windows Firewall with Advanced Security. WinRM firewall rule for Windows XP
sources are detailed in the Windows XP WinRM 2.0 Clients section.
Figure 17: Predefined Rule for WinRM 2.0
Once the WinRM firewall rule is enabled, update the group policy changes using gpupdate. Events
should be populating the collector’s log. If no events are received, then troubleshooting techniques are
provided in the Troubleshooting section.
2.6.2.2 Windows XP WinRM 2.0 Clients
Windows Firewall consists of two profiles: Domain and Standard. [19] The Domain Profile policy does not
provide a graphical advantage for configuring firewall rules.
Expand Computer Configuration > Policies > Administrative Templates > Network > Network
Connections > Windows Firewall > Domain Profile. To enable WinRM firewall rules:
1. Select Windows Firewall: Define inbound port exceptions policy
2. Select Enabled and click Show…
A port exception needs to be manually inserted. The syntax of the port exception is
Port:Transport:Scope:Status:Name
as detailed in the policy. Port specifies the targeted port in which this rule applies. The transport rule
specifies TCP or UDP. The scope details the IP address (or any IP with ‘*’) that can connect to the port.
Status indicates if the rule is enabled or disabled. Name is used to set a name for the rule.
19 http://technet.microsoft.com/en-us/library/bb490626.aspx
19