Windows Firewall exception rule added for application in suspicious file locations

title: Windows Firewall exception rule added for application in suspicious file locations
id: 18b106c7-afbc-4697-9ba2-3f39c037cc52
related:
  - id: cde0a575-7d3d-4a49-9817-b8004a7bf105
    type: derived
  - id: 9e2575e7-2cb9-4da1-adc8-ed94221dca5e
    type: derived
status: test
description: This rule identifies when a new Windows Defender Firewall exception rule is added for an application whose path is in common high-risk or temporary directories (for example, PerfLogs, Temp/Tmp, Users\Public, Windows\Tasks, and AppData\Local\Temp). Attackers may use this to enable or bypass network access for malicious or staging binaries while reducing detection. It relies on Windows Firewall-API events that record firewall exception changes, using Event IDs 2004, 2071, and 2097 plus application path substring matching.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml
author: frack113, Huntrule Team
date: 2023-02-26
modified: 2024-05-10
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2004
      - 2071
      - 2097
    ApplicationPath|contains:
      - :\PerfLogs\
      - :\Temp\
      - :\Tmp\
      - :\Users\Public\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
  filter_main_block:
    Action: 2
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1