Sigma rule: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Rule

Title

New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Status

test

Level

medium

Author

frack113, Nasreddine Bencherchali (Nextron Systems)

Date

2024-05-10

File

rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE).
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

Log source

product

windows

service

firewall-as

Detection

selection:
    EventID:
        - 2004 # A rule has been added to the Windows Defender Firewall exception list
        - 2071 # A rule has been added to the Windows Defender Firewall exception list. (Windows 11)
        - 2097
    Action: 3 # Allow
    ModifyingApplication|endswith: ':\Windows\System32\wbem\WmiPrvSE.exe'
condition: selection

False positives (as the rule lists them)

• Administrator scripts or activity.

Tags

• attack.defense-impairment
• attack.t1686.003

MITRE ATT&CK ids this rule names

• T1686.003

References

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
• https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
• https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml