huntrule

Windows Firewall Exception Rule Added for Application in Suspicious Path

Flags new Windows Defender Firewall exception rules for apps located in Temp/PerfLogs/Public/Tasks-like directories.

FreeReviewedSigma · High · v2
Product
windows
Service
firewall-as
Author
frack113 (SigmaHQ), DRL 1.1
Published
2023-02-26
Updated
2026-07-31
AnalysisDetection
title: Windows Firewall Exception Rule Added for Application in Suspicious Path
id: 18b106c7-afbc-4697-9ba2-3f39c037cc52
related:
  - id: cde0a575-7d3d-4a49-9817-b8004a7bf105
    type: derived
  - id: 9e2575e7-2cb9-4da1-adc8-ed94221dca5e
    type: derived
status: test
description: This rule flags the creation of a new Windows Defender Firewall exception rule when the application path is located in potentially suspicious directories such as PerfLogs, Temp, Public user content, or Windows Tasks/Temp. Attackers may add firewall exceptions to enable or hide malicious network activity by bypassing host-based network controls. It relies on firewall audit events (Event IDs 2004, 2071, and 2097) and the application path string match in the event.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml
author: frack113, Huntrule Team
date: 2023-02-26
modified: 2024-05-10
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2004
      - 2071
      - 2097
    ApplicationPath|contains:
      - :\PerfLogs\
      - :\Temp\
      - :\Tmp\
      - :\Users\Public\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
  filter_main_block:
    Action: 2
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1