Windows Firewall Exception Rule Added for Application in Suspicious Path
Flags new Windows Defender Firewall exception rules for apps located in Temp/PerfLogs/Public/Tasks-like directories.
- Product
- windows
- Service
- firewall-as
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-02-26
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags the creation of a new Windows Defender Firewall exception rule when the application path is located in potentially suspicious directories such as PerfLogs, Temp, Public user content, or Windows Tasks/Temp. Attackers may add firewall exceptions to enable or hide malicious network activity by bypassing host-based network controls. It relies on firewall audit events (Event IDs 2004, 2071, and 2097) and the application path string match in the event.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- app.any.runhttps://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall Exception Rule Added for Application in Suspicious Path
id: 18b106c7-afbc-4697-9ba2-3f39c037cc52
related:
- id: cde0a575-7d3d-4a49-9817-b8004a7bf105
type: derived
- id: 9e2575e7-2cb9-4da1-adc8-ed94221dca5e
type: derived
status: test
description: This rule flags the creation of a new Windows Defender Firewall exception rule when the application path is located in potentially suspicious directories such as PerfLogs, Temp, Public user content, or Windows Tasks/Temp. Attackers may add firewall exceptions to enable or hide malicious network activity by bypassing host-based network controls. It relies on firewall audit events (Event IDs 2004, 2071, and 2097) and the application path string match in the event.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml
author: frack113, Huntrule Team
date: 2023-02-26
modified: 2024-05-10
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2004
- 2071
- 2097
ApplicationPath|contains:
- :\PerfLogs\
- :\Temp\
- :\Tmp\
- :\Users\Public\
- :\Windows\Tasks\
- :\Windows\Temp\
- \AppData\Local\Temp\
filter_main_block:
Action: 2
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1