Windows Firewall Rule Modified

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•36

Detects when a rule has been modified in the Windows Firewall exception list. This can indicate an adversary attempting to bypass host-based firewall controls to enable command and control, lateral movement, or data exfiltration.