Detectionmediumexperimental
Allow Exceptions in Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft Defender Firewall and can restore network paths that a hardened profile would block.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic2 selectors
detection:
selection:
TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
TargetObject|endswith: '\DoNotAllowExceptions'
Details: 'DWORD (0x00000000)'
filter_main_svchost:
Image:
- 'C:\Windows\System32\svchost.exe'
- 'C:\Windows\SysWOW64\svchost.exe'
condition: selection and not 1 of filter_main_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
c69fc6a2-607d-4530-b7d1-75823af1bde4
Status
experimental
Level
medium
Type
Detection
Created
Tue Oct 13
Author
Path
rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions.yml
Raw Tags
attack.defense-impairmentattack.t1686.003