Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule
Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell ScriptBlock content that includes a New-NetFirewallRule invocation intended to create a firewall rule with an Allow action. Attackers can use this behavior to modify local network access rules during intrusion or follow-on activity. It relies on PowerShell ScriptBlock Logging telemetry that captures the script text being executed.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
- malware.newshttps://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
- cybersecuritynews.comhttps://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_new_netfirewallrule_allow.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-scriptblock-adds-windows-firewall-allow-rule-via-new-netfirewallrule-8d31dd2e
title: Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule
id: a826a242-acd5-446b-ae02-37df2072659b
related:
- id: 51483085-0cba-46a8-837e-4416496d6971
type: similar
- id: 8d31dd2e-b582-48ca-826e-dcaa2c1ca264
type: derived
status: test
description: This rule flags PowerShell ScriptBlock content that includes a New-NetFirewallRule invocation intended to create a firewall rule with an Allow action. Attackers can use this behavior to modify local network access rules during intrusion or follow-on activity. It relies on PowerShell ScriptBlock Logging telemetry that captures the script text being executed.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
- https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
- https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_new_netfirewallrule_allow.yml
author: frack113, Huntrule Team
date: 2024-05-10
tags:
- attack.defense-impairment
- attack.t1686.003
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: New-NetFirewallRule*-Action*Allow
condition: selection
falsepositives:
- Administrator script
level: low
license: DRL-1.1