GigaWiper Inbound Firewall Rule Creation via Masqueraded CloudExperienceHost

Duo Tech@duotech

•updated Jul 21, 2026•1•0•3

Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.