Windows Firewall Inbound Rule Addition via netsh advfirewall

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•7

Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.