firewall

Overview

The firewall action enumerates Windows Firewall rules and open TCP ports on remote systems. It queries the MSFT_NetFirewallRule and MSFT_NetProtocolPortFilter WMI classes in the ROOT\StandardCIMV2 namespace.

This action is available on Windows Server 2012+ and Windows 8+ systems that support the StandardCIMV2 namespace.

Syntax

SharpWMI.exe action=firewall computername=HOST[,HOST2,...] [username=DOMAIN\user] [password=Password]

Parameters

Parameter	Required	Description
`action`	Yes	Must be `firewall`
`computername`	Yes	Target host(s), comma-separated
`username`	No	Username for authentication
`password`	No	Password for authentication

Usage Examples

SharpWMI.exe action=firewall computername=server.domain.com

SharpWMI.exe action=firewall computername=web1,web2,db1,app1

SharpWMI.exe action=firewall computername=target.domain.com username="DOMAIN\admin" password="Password123!"

Example Output

  Scope: \\server.domain.com\ROOT\StandardCIMV2

Rulename   : Remote Desktop - User Mode (TCP-In)
Action     : 2 (Allow)
Direction  : 1 (Inbound)
LocalPorts : 3389

Rulename   : Windows Remote Management (HTTP-In)
Action     : 2 (Allow)
Direction  : 1 (Inbound)
LocalPorts : 5985

Rulename   : File and Printer Sharing (SMB-In)
Action     : 2 (Allow)
Direction  : 1 (Inbound)
LocalPorts : 445

Understanding Output

Action Values

Value	Meaning
2	Allow
3	AllowBypass
4	Block

Direction Values

Value	Meaning
1	Inbound
2	Outbound

Operational Use Cases

Scenario 1: Identify Remote Access Vectors

# Check for RDP, WinRM, PSRemoting
SharpWMI.exe action=firewall computername=target.domain.com

Look for rules allowing:

Port 3389 (RDP)
Port 5985/5986 (WinRM)
Port 22 (SSH)
Port 445 (SMB)

Scenario 2: Lateral Movement Planning

# Enumerate firewall across multiple systems
SharpWMI.exe action=firewall computername=server1,server2,server3,server4

Identify systems with:

Permissive firewall rules
Management ports open
Custom application ports
Outbound restrictions

Scenario 3: Egress Filtering Detection

Check for outbound rules that might block C2 traffic:

SharpWMI.exe action=firewall computername=target.domain.com

Look for:

Blocked outbound ports
Restricted protocols
Application-specific blocks

Scenario 4: Defense Evasion Planning

Identify allowed services and ports for blending in:

# Map allowed services across network
SharpWMI.exe action=firewall computername=dc1,fs1,sql1,web1

Remote Only

The firewall action requires a computername parameter and cannot target localhost directly.

This is a remote-only action. For local firewall enumeration, use:

# Local alternative using query action
SharpWMI.exe action=query query="SELECT DisplayName,Action,Direction FROM MSFT_NetFirewallRule WHERE Enabled=1" namespace="ROOT\StandardCIMV2"

Detection Considerations

WMI Detection

WMI queries to ROOT\StandardCIMV2 namespace
Queries for MSFT_NetFirewallRule class
Queries for MSFT_NetProtocolPortFilter class
Event ID 5857: WMI activity

Reconnaissance Indicators

Firewall enumeration across multiple systems
Queries originating from non-administrative systems
Bulk firewall queries in short timeframe
Correlation with other enumeration activities

Network Detection

WMI/DCOM traffic on port 135
Multiple connections to various systems
Queries from single source IP

Best Practices

Target Selection

Prioritize high-value targets (DCs, servers)
Focus on potential pivot points
Identify perimeter systems
Map DMZ configurations

Operational Security

Limit query frequency
Blend with legitimate admin activity
Avoid bulk queries
Use during business hours

Troubleshooting

Invalid Namespace Error

Cause: System doesn’t support StandardCIMV2 namespaceSolution:

Verify Windows version (8+ or Server 2012+)

Check WMI namespace exists:

wmic /namespace:\\root path __NAMESPACE where Name="StandardCIMV2" get Name

Use alternative query methods for older systems

Access Denied

Cause: Insufficient privilegesSolution:

Verify admin credentials
Use username and password parameters
Check UAC remote restrictions

No Results Returned

Cause: No firewall rules or query issueSolution:

Verify firewall service is running
Check if firewall is enabled
Test with manual WMI query

query

Custom firewall queries

loggedon

User enumeration

ps

Process enumeration

exec

Execute commands

Alternative Queries

All Firewall Rules

SharpWMI.exe action=query computername=target query="SELECT DisplayName,Action,Direction,Enabled FROM MSFT_NetFirewallRule" namespace="ROOT\StandardCIMV2"

Inbound Allow Rules Only

SharpWMI.exe action=query computername=target query="SELECT DisplayName FROM MSFT_NetFirewallRule WHERE Enabled=1 AND Direction=1 AND Action=2" namespace="ROOT\StandardCIMV2"

Blocked Ports

SharpWMI.exe action=query computername=target query="SELECT DisplayName,Direction FROM MSFT_NetFirewallRule WHERE Enabled=1 AND Action=4" namespace="ROOT\StandardCIMV2"

Getting Started

Enumeration Actions

Execution Actions

File Operations

Environment Variables

Overview

Syntax

Parameters

Usage Examples

Example Output

Understanding Output

Action Values

Direction Values

Operational Use Cases

Scenario 1: Identify Remote Access Vectors

Scenario 2: Lateral Movement Planning

Scenario 3: Egress Filtering Detection

Scenario 4: Defense Evasion Planning

Remote Only

Detection Considerations

Best Practices

Target Selection

Operational Security

Troubleshooting

query

loggedon

ps

exec

Alternative Queries

​Overview

​Syntax

​Parameters

​Usage Examples

​Example Output

​Understanding Output

​Action Values

​Direction Values

​Operational Use Cases

​Scenario 1: Identify Remote Access Vectors

​Scenario 2: Lateral Movement Planning

​Scenario 3: Egress Filtering Detection

​Scenario 4: Defense Evasion Planning

​Remote Only

​Detection Considerations

​Best Practices

Target Selection

Operational Security

​Troubleshooting

​Related Actions

query

loggedon

ps

exec

​Alternative Queries

Overview

Syntax

Parameters

Usage Examples

Example Output

Understanding Output

Action Values

Direction Values

Operational Use Cases

Scenario 1: Identify Remote Access Vectors

Scenario 2: Lateral Movement Planning

Scenario 3: Egress Filtering Detection

Scenario 4: Defense Evasion Planning

Remote Only

Detection Considerations

Best Practices

Troubleshooting

Related Actions

Alternative Queries