Firewall deletion commands targeted names also reported as services
Sandbox events associated with an upWire executable show elevated commands requesting deletion of firewall rules named `upWire` and `wire`; separate file records report those names as service locations. The overlap gives the commands a service-related context, but the records do not show whether either rule was deleted or why the commands were issued.
Two Windows firewall rules named upWire and wire were targeted for deletion in sandbox events associated with an upWire executable. Those same names appear separately as service-registry locations reported for two distinct files. The correspondence raises a more useful question than whether a firewall alert fired: was the software managing its own service-related network settings, or trying to remove a security restriction?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read