New Firewall Rule Added For Suspicious Application Path

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•21

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location. Adversaries may modify system firewalls to bypass controls limiting network usage, enabling C2 communications, lateral movement, and/or data exfiltration.