New Windows Firewall Allow Rule Added Via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•23

Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action. This activity can be indicative of an adversary attempting to bypass network controls for C2, lateral movement, or data exfiltration.