Sigma rule: Firewall Rule Modified In The Windows Firewall Exception List

Rule

Title

Firewall Rule Modified In The Windows Firewall Exception List

Status

test

Level

low

Author

frack113

Date

2022-02-19

Modified

2024-01-22

File

rules-threat-hunting/windows/builtin/firewall_as/win_firewall_as_change_rule.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a rule has been modified in the Windows firewall exception list

Log source

product

windows

service

firewall-as

Detection

selection:
    EventID:
        - 2005 # A rule has been modified in the Windows Defender Firewall exception list (Windows 10)
        - 2073 # A rule has been modified in the Windows Defender Firewall exception list. (Windows 11)
filter_optional_teams:
    ApplicationPath|endswith: '\AppData\local\microsoft\teams\current\teams.exe'
filter_optional_keybase:
    ApplicationPath|endswith: '\AppData\Local\Keybase\keybase.exe'
filter_optional_messenger:
    ApplicationPath|endswith: '\AppData\Local\Programs\Messenger\Messenger.exe'
filter_optional_opera:
    ApplicationPath|contains|all:
        - ':\Users\'
        - '\AppData\Local\Programs\Opera\'
        - '\opera.exe'
filter_optional_brave:
    ApplicationPath|contains|all:
        - ':\Users\'
        - '\AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe'
condition: selection and not 1 of filter_optional_*

Tags

• attack.defense-impairment
• attack.t1686.003
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1686.003

References

• https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/builtin/firewall_as/win_firewall_as_change_rule.yml