New Blocking Firewall Rule For Critical Service/Application Added In Windows Firewall Exception List

Nasreddine Bencherchali (Nextron Systems)

Detects the addition of a new "Block" firewall rule targeting critical services and application paths and binaries. An attacker can leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule" to add block rules targeting security services and applications in order to stop communication between them and their management console.

2024-07-09 00:00:00

None

062c0a82-ef00-4a65-9c81-1d5a9856222c

attack.defense-evasion attack.t1562.004

Nextron Sigma feed only (private)