Event ID 4946: A rule was added to the Windows Firewall exception list
Written when a new Windows Firewall rule is added.
- Log
- Security
- Category
- Defense evasion
Why it matters
- Attackers add rules to allow inbound RDP, SMB or a backdoor's listening port.
What to check
Check the rule name, application, ports and direction, and who added it.
How to turn it on
Advanced Audit Policy: Policy Change > Audit MPSSVC Rule-Level Policy Change.
MITRE ATT&CK
- T1562.004 Disable or Modify System Firewall