attack.t1686.003

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

New Firewall Rule Added Via Netsh.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 attack.s0246 ·

Share on:

Detects the addition of a new rule to the Windows firewall via netsh

RDP Connection Allowed Via Netsh.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 ·

Share on:

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 ·

Share on:

Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

The Windows Defender Firewall Service Failed To Load Group Policy

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 ·

Share on:

Detects activity when The Windows Defender Firewall service failed to load Group Policy

Uncommon New Firewall Rule Added In Windows Firewall Exception List

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 ·

Share on:

Detects when a rule has been added to the Windows Firewall exception list

Windows Defender Firewall Has Been Reset To Its Default Configuration

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 ·

Share on:

Detects activity when Windows Defender Firewall has been reset to its default configuration

Windows Firewall Profile Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1686.003 ·

Share on:

Detects when a user disables the Windows Firewall via a Profile to help evade defense.