Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Read More

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Read More

Detects when a rule has been added to the Windows Firewall exception list

Read More

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

Read More

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

Read More

Detects activity when The Windows Defender Firewall service failed to load Group Policy

Read More

Detects activity when Windows Defender Firewall has been reset to its default configuration

Read More

Detects activity when the settings of the Windows firewall have been changed

Read More