New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•21

Detects when a PowerShell script uses the 'New-NetFirewallRule' cmdlet to create a new firewall rule with an 'Allow' action. This activity can indicate an adversary attempting to bypass host-based firewalls to enable command and control, lateral movement, or data exfiltration.