Firewall Configuration Discovery Via Netsh.exe
This rule detects the execution of 'netsh.exe' with command-line arguments indicating an attempt to discover firewall configurations. Specifically, it looks for 'netsh' combined with 'show firewall' and additional keywords like 'config', 'state', or 'rule', or 'name=all'. This activity is often performed by adversaries to understand the network environment and identify potential egress points or defensive measures.
Sigma
