All Rules Deleted From Windows Firewall Configuration
Detects when all rules have been deleted from the Windows Defender Firewall configuration. This action can be performed by an attacker to bypass network controls and facilitate command and control, lateral movement, or data exfiltration.
Sigma
