Windows Defender Firewall Reset to Default Configuration (Firewall-as Log)

title: Windows Defender Firewall Reset to Default Configuration (Firewall-as Log)
id: 026d4961-d740-47a9-88c8-66cfdef20459
status: test
description: This rule identifies events where Windows Defender Firewall is reset to its default configuration, including Windows 11 variants. Resetting firewall settings can enable defense impairment by reverting custom restrictions that were previously in place. It relies on firewall-as telemetry capturing the specific reset events by EventID.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_reset_config.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2023-04-21
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2032
      - 2060
  condition: selection
level: low
license: DRL-1.1
related:
  - id: 04b60639-39c0-412a-9fbe-e82499c881a3
    type: derived