Tag
medium
advisory
Detection of Unauthorized Windows Firewall Exception Rule Creation
1 ruleMonitoring for non-standard additions to the Windows Defender Firewall exception list to identify potential defense impairment activity by unauthorized processes.
defense-impairment
windows-firewall
monitoring
1r
medium
advisory
UAC Bypass via Windows Firewall MMC Snap-In Hijack
2 rules 2 TTPsAttackers bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in to execute code with elevated permissions, potentially leading to system compromise.
Windows
uac-bypass
privilege-escalation
windows-firewall
mmc
2r
2t