Windows Firewall Status Queried Remotely
This rule detects attempts to query Windows Firewall status remotely over TCP port 445 (SMB). The detection is based on the presence of the case-insensitive string "FirewallProduct" in the network flow, indicating a potential query for firewall product information. This activity could be part of a reconnaissance phase by an attacker to understand the target's security posture.
Suricata
