Host Isolation via Netsh Firewall Modification

Brandon Rodriguez@BMRodriguez

•updated Jan 28, 2026•3•1•37

Detects the use of netsh.exe to create a firewall rule that blocks all outbound traffic. This technique is often used by attackers to isolate a compromised host from external resources (like security tool cloud consoles) while maintaining internal network access for lateral movement.