Netsh commands target firewall rules matching wire and upWire service names
Two process-creation events show commands requesting deletion of firewall rules named `wire` and `upWire`, matching names in associated service artifacts. The match warrants examining the software’s service and firewall configuration together, but the records do not show whether either deletion succeeded or who initiated the commands.
Two recorded Windows process-creation events invoke netsh to delete firewall rules named wire and upWire. Separately, the associated file profiles report Windows service locations bearing those same names. The match raises a more specific question than a generic firewall alert: was software managing its own network rules, or was an unauthorized change being made to the host’s controls?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read