Inbound Firewall Rule Creation From Userwritable Location

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•4

Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.