Add Authorized Applications to Microsoft Defender Firewall via Registry

calendar Oct 13, 2026 · attack.defense-impairment attack.t1686.003  ·
Share on: linkedin copy

Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.

Sigma rule (View on GitHub)

 1title: Add Authorized Applications to Microsoft Defender Firewall via Registry
 2id: 6648f900-4a7d-47e3-bad6-952b313a1c0e
 3status: experimental
 4description: |
 5    Detects the degradation of the system firewall security by the creation or re-enabling of per-application
 6    exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
 7    the targeted executable network access and can be abused by malware to bypass network restrictions.    
 8references:
 9    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
10    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
11    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
12    - https://www.greatis.com/appdata/d/q/qykernel.exe.htm
13    - https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
14author: frack113
15date: 2026-10-13
16tags:
17    - attack.defense-impairment
18    - attack.t1686.003
19logsource:
20    category: registry_set
21    product: windows
22detection:
23    selection:
24        TargetObject|contains|all:
25            - '\Services\SharedAccess\Parameters\FirewallPolicy\'
26            - '\AuthorizedApplications\List'
27        Details|contains: ':Enabled:'
28    condition: selection
29falsepositives:
30    - Unknown
31level: medium
32regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception/info.yml

References

Related rules

to-top