New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

SigmaHQ Detections@sigmaHQ

•updated Sep 3, 2026•0•0•4

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".