Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the execution of PowerShell cmdlets 'Get-NetFirewallRule' or 'Show-NetFirewallRule' to enumerate local firewall rules on a host. This activity is often performed by adversaries during the discovery phase to understand network configurations and potential egress/ingress points.