Detectionmediumexperimental
Add Authorized Applications to Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|contains|all:
- '\Services\SharedAccess\Parameters\FirewallPolicy\'
- '\AuthorizedApplications\List'
Details|contains: ':Enabled:'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
6648f900-4a7d-47e3-bad6-952b313a1c0e
Status
experimental
Level
medium
Type
Detection
Created
Tue Oct 13
Author
Path
rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception.yml
Raw Tags
attack.defense-impairmentattack.t1686.003