New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Severity: medium
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1562.004` Impair Defenses: Disable or Modify System Firewall

Event coverage

Provider	Event ID	Title
Windows-Firewall-With-Advanced-Security	2004
Windows-Firewall-With-Advanced-Security	2071
Windows-Firewall-With-Advanced-Security	2097

Stages and Predicates

Stage 1: `selection`

Action: 3
ModifyingApplication|endswith: ':\Windows\System32\wbem\WmiPrvSE.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Action`	eq	`3`
`ModifyingApplication`	ends_with	`:\Windows\System32\wbem\WmiPrvSE.exe`

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.

Uncommon New Firewall Rule Added In Windows Firewall Exception List [sigma] (drops 2 filters this rule applies) (first-stage match only; downstream stages may differ)

Often fire together

Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.

Share event IDs (chain-detection candidates)

Rules that observe the same Windows event-ID pairs as this one. If you're authoring a multi-stage / sequence rule that spans these events, these are the existing detections that already cover one or both endpoints.