BLUERABBIT Deceptive Firewall Rule Creation

Ethan Andrews@eandrews

•updated Jun 12, 2026•3•0•4

Detects the creation of a firewall rule using 'netsh.exe' or PowerShell ('New-NetFirewallRule') that includes the deceptive name 'Microsoft.Windows.CloudExperienceHost'. This specific naming convention is associated with the BLUERABBIT backdoor, which uses it to allow inbound VNC remote access.