Uncommon New Firewall Rule Added In Windows Firewall Exception List
Detects when a new rule has been added to the Windows Firewall exception list, specifically looking for uncommon or potentially malicious additions by filtering out common system paths and applications. This rule aims to identify defense evasion attempts where adversaries modify firewall rules to allow their command and control traffic or other malicious network activity.
Sigma
