PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.

FreeReviewedSigma · Low · v5
Product
windows
Category
ps_module
Author
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
Published
2023-07-13
Updated
2026-07-31

ATT&CK techniques

Discovery
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags PowerShell activity that invokes Get-NetFirewallRule or Show-NetFirewallRule to enumerate local firewall rules on a host. Enumerating firewall configuration is a common discovery step that helps an attacker understand which inbound/outbound controls are in place before attempting evasion or lateral movement. It relies on PowerShell module telemetry capturing the command text in both payload and context fields.

Related detections9 linkedT1016 — drag to rearrange
Suspicious Codepage Change Followed By Nltest Domain Trust Discovery
Suspicious Domain Trust Discovery Via Nltest
Antivirus Software Discovery via tasklist and findstr
Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)
Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)
Suspicious Scheduled Task Enumerated (via process_creation)
Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)
PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules
Pivot detection · T1016 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.