Windows Firewall Allow Rule Added via WmiPrvSE.exe
Flags Windows firewall allow-rule additions where WmiPrvSE.exe is the modifying application.
- Product
- windows
- Service
- firewall-as
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when a new Windows Defender Firewall exception entry is added with an Allow action and the modifying application is WmiPrvSE.exe. Attackers can use WMI to alter local firewall policy to enable or maintain access while bypassing host-based network restrictions. Telemetry relies on Windows Firewall/Defender firewall logging events that record rule creation (Event IDs 2004/2071/2097), the rule action, and the process path ending in WmiPrvSE.exe.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
- malware.newshttps://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
- cybersecuritynews.comhttps://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall Allow Rule Added via WmiPrvSE.exe
id: 2e401d54-6ca9-4412-a1b7-1b43468af1f9
status: test
description: This rule identifies when a new Windows Defender Firewall exception entry is added with an Allow action and the modifying application is WmiPrvSE.exe. Attackers can use WMI to alter local firewall policy to enable or maintain access while bypassing host-based network restrictions. Telemetry relies on Windows Firewall/Defender firewall logging events that record rule creation (Event IDs 2004/2071/2097), the rule action, and the process path ending in WmiPrvSE.exe.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
- https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
- https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-05-10
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2004
- 2071
- 2097
Action: 3
ModifyingApplication|endswith: :\Windows\System32\wbem\WmiPrvSE.exe
condition: selection
falsepositives:
- Administrator scripts or activity.
level: medium
license: DRL-1.1
related:
- id: eca81e8d-09e1-4d04-8614-c91f44fd0519
type: derived