Windows Firewall Tampering via netsh advfirewall (T1562.004)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.