Firewall Rule Deleted Via Netsh.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•24

Detects the removal of a port or application rule in the Windows Firewall configuration using the netsh.exe command-line utility. This activity can be indicative of an adversary attempting to impair defenses to facilitate further malicious activity.