Detectionlowtest

The Windows Defender Firewall Service Failed To Load Group Policy

Detects activity when The Windows Defender Firewall service failed to load Group Policy

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François HubautCreated Sat Feb 19Updated Tue Jan 177ec15688-fd24-4177-ba43-1a950537ee39windows

Log Source

Windowsfirewall-as

ProductWindows← raw: windows

Servicefirewall-as← raw: firewall-as

Detection Logic

detection:
    selection:
        EventID: 2009 # The Windows Defender Firewall service failed to load Group Policy
    condition: selection

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

7ec15688-fd24-4177-ba43-1a950537ee39

Status

test

Level

low

Type

Detection

Created

Sat Feb 19

Modified

Tue Jan 17

Author

Path

rules/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml

Raw Tags

attack.defense-evasionattack.t1562.004