Firewall Disabled via Netsh.exe Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•30

Detects the use of 'netsh.exe' commands to disable the Windows firewall. This includes commands targeting both the legacy 'firewall' context and the 'advfirewall' (Windows Defender Firewall with Advanced Security) context, specifically looking for parameters that set the firewall state to disabled or off.