PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules
Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.
- Product
- windows
- Category
- ps_module
- Author
- Christopher Peacock @SecurePeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
- Published
- 2023-07-13
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell activity that invokes Get-NetFirewallRule or Show-NetFirewallRule to enumerate local firewall rules on a host. Enumerating firewall configuration is a common discovery step that helps an attacker understand which inbound/outbound controls are in place before attempting evasion or lateral movement. It relies on PowerShell module telemetry capturing the command text in both payload and context fields.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_module/posh_pm_susp_netfirewallrule_recon.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules
id: f5dae52f-1d01-405e-ba9b-afdec9bbe4bf
status: test
description: This rule flags PowerShell activity that invokes Get-NetFirewallRule or Show-NetFirewallRule to enumerate local firewall rules on a host. Enumerating firewall configuration is a common discovery step that helps an attacker understand which inbound/outbound controls are in place before attempting evasion or lateral movement. It relies on PowerShell module telemetry capturing the command text in both payload and context fields.
references:
- https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
- https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_module/posh_pm_susp_netfirewallrule_recon.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-07-13
tags:
- detection.threat-hunting
- attack.discovery
- attack.t1518.001
- attack.t1016
logsource:
product: windows
category: ps_module
definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
selection_payload:
Payload|contains:
- Get-NetFirewallRule
- Show-NetFirewallRule
selection_contextinfo:
ContextInfo|contains:
- Get-NetFirewallRule
- Show-NetFirewallRule
condition: 1 of selection_*
falsepositives:
- Administration scripts
level: low
license: DRL-1.1
related:
- id: ea207a23-b441-4a17-9f76-ad5be47d51d3
type: derived