SignalHunt
← All rules

FW-7003

high

Administrative Port Allowed Inbound from an Untrusted Zone

Detects the firewall allowing an inbound connection to a remote-administration port (RDP, SMB) from an untrusted/external zone - exposing a high-value lateral-movement and initial-access surface directly to the internet.

T1021.001
Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `action` is "allow" AND `zone_src` is "untrust" AND `dst_port` is 3389 or 445.

{
  "detection_type": "selection",
  "selection": {
    "action": "allow",
    "zone_src": "untrust",
    "dst_port": [
      3389,
      445
    ]
  }
}

Log source: category=firewall · Event ID(s): fw_allow

Required log fields

  • action
  • zone_src
  • dst_port

Enabling this in your environment

Where: Firewall traffic logging - allowed sessions

Enable allow-session logging on inbound rules - many firewalls only log denies by default, so successful inbound connections stay invisible unless allow-logging is explicitly turned on per rule.

This is a rule about exposure, not an active attack signature - a single hit means the rulebase itself needs review, not just the one session.

Seen in incidents

False positives

  • An intentional, source-IP-restricted RDP/SMB jump host rule
  • Site-to-site VPN traffic misclassified into the untrust zone

References