Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1686.003

Windows Host Firewall

Defense Impairment 22 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
sigma A Rule Has Been Deleted From The Windows Firewall Exception List test 2026-10-19
sigma Allow Exceptions in Microsoft Defender Firewall via Registry experimental 2026-10-13
sigma Add Authorized Applications to Microsoft Defender Firewall via Registry experimental 2026-10-13
sigma Uncommon New Firewall Rule Added In Windows Firewall Exception List test 2026-08-27
sigma Firewall Rule Deleted Via Netsh.EXE test 2025-10-07
sigma New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock test 2024-05-10
sigma New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application test 2024-05-10
sigma New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE test 2024-05-10
sigma New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet test 2024-05-03
sigma Disable Microsoft Defender Firewall via Registry test 2024-03-25
sigma Firewall Rule Modified In The Windows Firewall Exception List test 2024-01-22
sigma All Rules Have Been Deleted From The Windows Firewall Configuration test 2024-01-22
sigma Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE test 2023-12-11
sigma RDP Connection Allowed Via Netsh.EXE test 2023-12-11
sigma Disable Windows Firewall by Registry test 2023-08-17
sigma Windows Defender Firewall Has Been Reset To Its Default Configuration test 2023-04-21
sigma Windows Firewall Settings Have Been Changed test 2023-04-21
sigma Netsh Allow Group Policy on Microsoft Defender Firewall test 2023-02-14
sigma Firewall Disabled via Netsh.EXE test 2023-02-13
sigma New Firewall Rule Added Via Netsh.EXE test 2023-02-10
sigma The Windows Defender Firewall Service Failed To Load Group Policy test 2023-01-17
sigma Windows Firewall Profile Disabled test 2022-12-30