Suspicious New Firewall Rule Added In Windows Firewall Exception List Through WmiPrvSE.EXE (via firewall-as)

title: Suspicious New Firewall Rule Added In Windows Firewall Exception List Through WmiPrvSE.EXE (via firewall-as)
id: 47187a08-d594-5c06-b192-462e34489789
status: stable
description: This rule detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an adversary abuses PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
references:
    - https://attack.mitre.org/techniques/T1686/003/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
    - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
    - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
author: Huntrule Team
date: 2026-03-21
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    product: windows
    service: firewall-as
detection:
    selection:
        EventID:
            - 2004
            - 2071
            - 2097
        Action: 3
        ModifyingApplication|endswith: ':\Windows\System32\wbem\WmiPrvSE.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium