Windows Firewall Disabled via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.