List Local Firewall Deletions

Description

List Local Firewall Deletions

Query · kql

DeviceProcessEvents
| where ProcessCommandLine contains "firewall delete"
| where InitiatingProcessFileName != "Microsoft.Tri.Sensor.Updater.exe" // DFI sensor
| project-reorder
     Timestamp,
     DeviceName,
     AccountName,
     ProcessCommandLine,
     InitiatingProcessCommandLine
Raw source List Local Firewall Deletions · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# List Local Firewall Deletions

## Query Information

#### Description
List Local Firewall Deletions

## Defender XDR
```KQL
DeviceProcessEvents
| where ProcessCommandLine contains "firewall delete"
| where InitiatingProcessFileName != "Microsoft.Tri.Sensor.Updater.exe" // DFI sensor
| project-reorder
     Timestamp,
     DeviceName,
     AccountName,
     ProcessCommandLine,
     InitiatingProcessCommandLine
```

## Sentinel
```KQL
DeviceProcessEvents
| where ProcessCommandLine contains "firewall delete"
| where InitiatingProcessFileName != "Microsoft.Tri.Sensor.Updater.exe" // DFI sensor
| project-reorder
     TimeGenerated,
     DeviceName,
     AccountName,
     ProcessCommandLine,
     InitiatingProcessCommandLine
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.