Inbound Firewall Allow Rule from Untrusted Process

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•1•3

This rule detects the creation of an inbound firewall allow rule by `netsh` or `powershell` when the initiating process (actor) is launched from a user-writable location such as `temp`, `appdata`, `programdata`, or `users\public`. This behavior can indicate malicious activity where an adversary attempts to establish network access or persistence by modifying firewall settings from an unusual or untrusted execution path.