Sigma rule: Add Authorized Applications to Microsoft Defender Firewall via Registry

Rule

Title

Add Authorized Applications to Microsoft Defender Firewall via Registry

Status

experimental

Level

medium

Author

frack113

Date

2026-10-13

File

rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the degradation of the system firewall security by the creation or re-enabling of per-application
exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
the targeted executable network access and can be abused by malware to bypass network restrictions.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains|all:
        - '\Services\SharedAccess\Parameters\FirewallPolicy\'
        - '\AuthorizedApplications\List'
    Details|contains: ':Enabled:'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense-impairment
• attack.t1686.003

MITRE ATT&CK ids this rule names

• T1686.003

References

• https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
• https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
• https://www.greatis.com/appdata/d/q/qykernel.exe.htm
• https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception.yml