TS Phish - RDP Firewall Exception Creation (T1562.004)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•4•0•8

Detects the netsh utility being abused to explicitly open port 3389 in the Windows Defender Firewall to allow inbound RDP traffic.