Windows Firewall Settings Changed

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects when settings of the Windows firewall have been changed, indicated by specific Event IDs from the Windows Defender Firewall with Advanced Security log. This can be an indicator of an adversary attempting to bypass network controls.