Windows Firewall Profile Disabled via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects when a user disables the Windows Firewall via a PowerShell command targeting specific profiles (All, Public, Domain, or Private). This activity is often performed by adversaries to evade defense mechanisms and allow unauthorized network communication.