Netsh Modifying Microsoft Defender Firewall Rules

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the use of 'netsh.exe' to modify Microsoft Defender Firewall rules. Specifically, it looks for command-line arguments that indicate the setting of a new firewall rule with 'group=' and 'enable=Yes', which could be used by adversaries to bypass network controls.