Disable Microsoft Defender Firewall via Registry
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage
Sigma rule (View on GitHub)
1title: Disable Microsoft Defender Firewall via Registry
2id: 974515da-6cc5-4c95-ae65-f97f9150ec7f
3status: test
4description: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry
7author: frack113
8date: 2022/01/09
9modified: 2024/03/25
10tags:
11 - attack.defense_evasion
12 - attack.t1562.004
13logsource:
14 category: registry_set
15 product: windows
16detection:
17 selection:
18 # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall
19 # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall
20 # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall
21 TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
22 TargetObject|endswith: '\EnableFirewall'
23 Details: 'DWORD (0x00000000)'
24 condition: selection
25falsepositives:
26 - Unknown
27level: medium
References
Related rules
- Windows Defender Firewall Has Been Reset To Its Default Configuration
- Windows Firewall Settings Have Been Changed
- All Rules Have Been Deleted From The Windows Firewall Configuration
- New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
- Uncommon New Firewall Rule Added In Windows Firewall Exception List