Sigma rule: Allow Exceptions in Microsoft Defender Firewall via Registry

Rule

Title

Allow Exceptions in Microsoft Defender Firewall via Registry

Status

experimental

Level

medium

Author

frack113

Date

2026-10-13

File

rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
    TargetObject|endswith: '\DoNotAllowExceptions'
    Details: 'DWORD (0x00000000)'
filter_main_svchost:
    Image:
        - 'C:\Windows\System32\svchost.exe'
        - 'C:\Windows\SysWOW64\svchost.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense-impairment
• attack.t1686.003

MITRE ATT&CK ids this rule names

• T1686.003

References

• https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
• https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
• https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions.yml