Suspicious A Rule Has Been Deleted From The Windows Firewall Exception List (via firewall-as)

title: Suspicious A Rule Has Been Deleted From The Windows Firewall Exception List (via firewall-as)
id: a60686e1-5164-524b-9c76-b05190173745
status: stable
description: This rule detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall
references:
    - https://attack.mitre.org/techniques/T1686/003/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
author: Huntrule Team
date: 2026-02-01
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    product: windows
    service: firewall-as
detection:
    selection:
        EventID:
            - 2006
            - 2052
    filter_main_generic:
        ModifyingApplication|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\WinSxS\'
    filter_main_svchost:
        ModifyingApplication: 'C:\Windows\System32\svchost.exe'
    filter_optional_msmpeng:
        ModifyingApplication|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
        ModifyingApplication|endswith: '\MsMpEng.exe'
    filter_main_null:
        ModifyingApplication:
    filter_main_empty:
        ModifyingApplication: ''
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium