PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.

FreeReviewedSigma · Low · v5

Product: windows
Category: ps_module
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
Published: 2023-07-13
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
- T1518.001Security Software Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell activity that invokes Get-NetFirewallRule or Show-NetFirewallRule to enumerate local firewall rules on a host. Enumerating firewall configuration is a common discovery step that helps an attacker understand which inbound/outbound controls are in place before attempting evasion or lateral movement. It relies on PowerShell module telemetry capturing the command text in both payload and context fields.

Reporting behind it

Related detections9 linkedT1518.001 — drag to rearrange

Suspicious Antivirus Enumeration via WMIC SecurityCenter2

Suspicious Security Product Discovery via tasklist and findstr (via process_creation)

Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)

Suspicious External Address Reconnaissance via curl to ifconfig me via process_creation

Suspicious Defender and Session Reconnaissance via sc query and quser

Suspicious Security Software Discovery via findstr Filtering of AV Process Names (via process_creation)

Suspicious Domain Trust Discovery via Nltest

Suspicious Antivirus Product Discovery via WMIC SecurityCenter2 Query

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Pivot detection · T1518.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-local-firewall-rule-enumeration-using-get-netfirewallrule-show-netfir-ea207a23

title: PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules
id: f5dae52f-1d01-405e-ba9b-afdec9bbe4bf
status: test
description: This rule flags PowerShell activity that invokes Get-NetFirewallRule or Show-NetFirewallRule to enumerate local firewall rules on a host. Enumerating firewall configuration is a common discovery step that helps an attacker understand which inbound/outbound controls are in place before attempting evasion or lateral movement. It relies on PowerShell module telemetry capturing the command text in both payload and context fields.
references:
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_module/posh_pm_susp_netfirewallrule_recon.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-07-13
tags:
  - detection.threat-hunting
  - attack.discovery
  - attack.t1518.001
  - attack.t1016
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_payload:
    Payload|contains:
      - Get-NetFirewallRule
      - Show-NetFirewallRule
  selection_contextinfo:
    ContextInfo|contains:
      - Get-NetFirewallRule
      - Show-NetFirewallRule
  condition: 1 of selection_*
falsepositives:
  - Administration scripts
level: low
license: DRL-1.1
related:
  - id: ea207a23-b441-4a17-9f76-ad5be47d51d3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL