Allow Exceptions in Microsoft Defender Firewall via Registry

calendar Oct 13, 2026 · attack.defense-impairment attack.t1686.003  ·
Share on: linkedin copy

Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft Defender Firewall and can restore network paths that a hardened profile would block.

Sigma rule (View on GitHub)

 1title: Allow Exceptions in Microsoft Defender Firewall via Registry
 2id: c69fc6a2-607d-4530-b7d1-75823af1bde4
 3status: experimental
 4description: |
 5    Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
 6    set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
 7    Defender Firewall and can restore network paths that a hardened profile would block.    
 8references:
 9    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
10    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
11    - https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
12    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
13author: frack113
14date: 2026-10-13
15tags:
16    - attack.defense-impairment
17    - attack.t1686.003
18logsource:
19    category: registry_set
20    product: windows
21detection:
22    selection:
23        TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
24        TargetObject|endswith: '\DoNotAllowExceptions'
25        Details: 'DWORD (0x00000000)'
26    filter_main_svchost:
27        Image:
28            - 'C:\Windows\System32\svchost.exe'
29            - 'C:\Windows\SysWOW64\svchost.exe'
30    condition: selection and not 1 of filter_main_*
31falsepositives:
32    - Unknown
33level: medium
34regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions/info.yml

References

Related rules

to-top