Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)
Flags Windows where Windows Defender Firewall is reset to default settings via firewall-as events.
- Product
- windows
- Service
- firewall-as
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when Windows Defender Firewall is reset back to its default configuration, including a Windows 11-specific event variant. Attackers may reset firewall settings to undo prior hardening, restore permissive defaults, or disrupt defensive changes. The detection relies on firewall-as telemetry capturing the relevant Windows event IDs (2032 and 2060).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)
id: 026d4961-d740-47a9-88c8-66cfdef20459
status: test
description: This rule identifies when Windows Defender Firewall is reset back to its default configuration, including a Windows 11-specific event variant. Attackers may reset firewall settings to undo prior hardening, restore permissive defaults, or disrupt defensive changes. The detection relies on firewall-as telemetry capturing the relevant Windows event IDs (2032 and 2060).
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_reset_config.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2023-04-21
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2032
- 2060
condition: selection
level: low
license: DRL-1.1
related:
- id: 04b60639-39c0-412a-9fbe-e82499c881a3
type: derived