Windows Firewall Configuration Changed (Event IDs 2002/2003/2008/2082/2083)

title: Windows Firewall Configuration Changed (Event IDs 2002/2003/2008/2082/2083)
id: 1466246a-1ea9-464a-895b-5f9045587c94
status: test
description: This rule flags Windows Firewall events indicating firewall settings were changed, including Windows Defender Firewall and profile-specific updates. Attackers may alter firewall rules to reduce visibility or enable/allow malicious network activity, so configuration changes are security-relevant. It relies on Windows Firewall service telemetry capturing the specified firewall change event IDs.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_setting_change.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-19
modified: 2023-04-21
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2002
      - 2083
      - 2003
      - 2082
      - 2008
  condition: selection
level: low
license: DRL-1.1
related:
  - id: 00bb5bd5-1379-4fcf-a965-a5b6f7478064
    type: derived