RDP Connection Allowed Via Netsh.exe Firewall Rule Modification
Detects the usage of the `netsh.exe` command-line utility to modify system firewall rules, specifically to open port 3389 for RDP connections. This activity has been observed in campaigns involving the Sarwent malware, where adversaries manipulate firewall settings to enable remote access.
Sigma
