• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Windows filtering events (Firewall)

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•21

    Get all filtering events done by the Windows filtering platform. This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls. When no Firewall rules are configured, the default behavior is to block all incoming network connections.

    Microsoft Sentinel (KQL)

    Tags

    TA0011 - Command and ControlT1562.004 - Disable or Modify System FirewallDS0018 - FirewallT1498 - Network Denial of ServiceTA0005 - Defense EvasionTA0040 - ImpactT1562.007 - Disable or Modify Cloud FirewallT1584.008 - Network DevicesDS0029 - Network TrafficM1030 - Network SegmentationT1016.001 - Internet Connection DiscoveryT1021.008 - Direct Cloud VM ConnectionsS0481 - Ragnar LockerTA0042 - Resource DevelopmentTA0007 - DiscoveryTA0008 - Lateral MovementFirewall EventNetwork Connection OutboundNetwork Connection InboundNetwork Connection BlockedWindowsWindows Advanced FirewallMicrosoft Iiskql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?