Skip to content
Threat Feed
Subscribe

Product

Windows Firewall

4 briefs RSS
medium advisory

Netsh Used to Enable Remote Desktop Protocol (RDP) in Windows Firewall

Adversaries use the `netsh.exe` utility to enable inbound Remote Desktop Protocol (RDP) connections through the Windows Firewall, potentially for unauthorized remote access and lateral movement.

Windows +1 defense-evasion lateral-movement rdp
2r 2t
high advisory

Firewall Disabled via Netsh Command

Detection of Windows Firewall being disabled via the `netsh` command, potentially exposing the system to external threats and unauthorized communication.

Windows Firewall defense-evasion endpoint windows
2r 1t
medium advisory

Netsh Used to Enable Remote Desktop Protocol (RDP) in Windows Firewall

Adversaries may use the `netsh.exe` utility to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall, potentially allowing unauthorized remote access to compromised systems.

Windows Firewall +4 defense-evasion lateral-movement windows netsh rdp
2r 2t
high advisory

Firewall Rule Manipulation via COM API

A tool enables threat actors to add, remove, or query Windows Firewall rules via the COM API (INetFwPolicy2), bypassing traditional command-line tools and potentially evading detection.

Windows Firewall firewall defense-evasion lateral-movement
2r 1t