PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule
Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-03
- Updated
- 2026-07-31
What it detects
This rule identifies process executions of PowerShell that invoke the New-NetFirewallRule cmdlet to create a new Windows firewall rule with an Allow action. Adding firewall allow rules can enable persistence or facilitate network access for malicious tooling by modifying host network filtering. It relies on process creation telemetry capturing the executable image (PowerShell variants) and the command line containing the specific cmdlet parameters.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
- malware.newshttps://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
- cybersecuritynews.comhttps://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_new_netfirewallrule_allow.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-new-netfirewallrule-adds-windows-allow-firewall-rule-51483085
title: PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule
id: a0839538-beb7-4617-8f90-105e72ac367b
related:
- id: 8d31dd2e-b582-48ca-826e-dcaa2c1ca264
type: similar
- id: 51483085-0cba-46a8-837e-4416496d6971
type: derived
status: test
description: This rule identifies process executions of PowerShell that invoke the New-NetFirewallRule cmdlet to create a new Windows firewall rule with an Allow action. Adding firewall allow rules can enable persistence or facilitate network access for malicious tooling by modifying host network filtering. It relies on process creation telemetry capturing the executable image (PowerShell variants) and the command line containing the specific cmdlet parameters.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
- https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
- https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_new_netfirewallrule_allow.yml
author: frack113, Huntrule Team
date: 2024-05-03
tags:
- attack.defense-impairment
- attack.t1686.003
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_name:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- \powershell_ise.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_args:
CommandLine|contains|all:
- "New-NetFirewallRule "
- " -Action "
- allow
condition: all of selection_*
falsepositives:
- Administrator script
level: low
license: DRL-1.1