upWire analysis shows attempts to delete two named firewall rules
Two elevated process-creation events record commands targeting rules named `upWire` and `wire`, names that align with related software records. The events show attempts to remove specific rules, not a shutdown of Windows Firewall; whether the rules existed, were deleted or affected protection remains unknown.
Two Windows process-creation events record commands to delete firewall rules named upWire and wire. Both invoke netsh.exe through cmd.exe, and both record the new process running at High integrity. The immediate question is not simply whether a firewall command ran, but what removing those particular rules would change: was this software maintaining its own network settings, or interfering with a host’s protection?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read