High Volume of Firewall Rule Changes Detected

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.