Prometei Botnet Firewall Manipulation
Detects the use of 'netsh.exe' to create firewall rules with names specific to the Prometei botnet. Prometei creates rules to allow its own C2 traffic ("Secure Socket Tunneling Protocol (HTTP)") and to block other potential attackers ("Banned brute IPs") as part of its system hardening.
Microsoft Sentinel (KQL)
