Windows Firewall Rule Deleted
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
Sigma
