Detects the addition of a rule to the Windows Firewall exception list where the application resides in a suspicious folder

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Detects when a rule has been modified in the windows firewall exception list

Detects when a rule has been added to the Windows Firewall exception list

Detects activity when Windows Defender Firewall has been reset to its default configuration

Detects activity when the settings of the Windows firewall have been changed

Detects activity when The Windows Defender Firewall service failed to load Group Policy