Event ID 4946Audit SuccessSecurityT1562.004

Windows Event ID 4946 — Windows Firewall Exception Added

Logged when a new firewall exception rule is added to the Windows Firewall.

MITRE ATT&CK

Technique

T1562.004 · Disable or Modify System Firewall

Tactic

Defense Evasion

View on attack.mitre.org →

Why It Matters

Attackers add firewall exceptions to allow inbound connections for backdoors, C2 (command and control) tools, or remote access. Unexpected inbound allow rules — especially for unusual ports or executables — indicate persistence or C2 setup.

Key Fields

Rule NameThe name given to the exception — attackers often mimic legitimate rule names
ProfileDomain/Private/Public — Public profile exceptions are most dangerous
ApplicationThe path of the allowed application
PortThe port opened — non-standard ports are more suspicious

Investigation Tips

  1. 1.Review the Application path — exceptions for binaries in Temp, AppData, or ProgramData are high-risk.
  2. 2.Compare against the baseline of expected firewall rules from your GPO.
  3. 3.Check 4688 for the process that created the rule — netsh.exe is commonly used.

Go deeper: the full Living-Off-the-Land Binary Abuse (LOLBins) guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the Living-Off-the-Land Binary Abuse (LOLBins) guide →

See Event ID 4946 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →