Windows Firewall Exception Rule Added (Unusual) via Firewall-as Events

title: Windows Firewall Exception Rule Added (Unusual) via Firewall-as Events
id: c224d69c-eaeb-45b3-b75b-c8615913c8c1
status: test
description: This rule flags Windows Firewall exceptions when new rules are added, using firewall-as telemetry for Event IDs 2004, 2071, and 2097. Adding exception rules can reduce host network controls and may be used to enable unwanted inbound access or weaken defense posture. It focuses on additions while filtering common/benign paths and specific system-related modifying applications to reduce false positives.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2025-10-08
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2004
      - 2071
      - 2097
  filter_main_block:
    Action: 2
  filter_main_generic:
    ApplicationPath|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  filter_main_covered_paths:
    ApplicationPath|contains:
      - C:\PerfLogs\
      - C:\Temp\
      - C:\Tmp\
      - C:\Users\Public\
      - C:\Windows\Tasks\
      - C:\Windows\Temp\
      - \AppData\Local\Temp\
  filter_main_system_dllhost:
    ApplicationPath: System
    ModifyingApplication: C:\Windows\System32\dllhost.exe
  filter_main_tiworker:
    ModifyingApplication|startswith: C:\Windows\WinSxS\
    ModifyingApplication|endswith: \TiWorker.exe
  filter_main_null:
    ApplicationPath: null
  filter_optional_no_path:
    ModifyingApplication:
      - C:\Windows\System32\svchost.exe
      - C:\Windows\System32\dllhost.exe
    ApplicationPath: ""
  filter_optional_msmpeng:
    - ModifyingApplication|startswith:
        - C:\ProgramData\Microsoft\Windows Defender\Platform\
        - C:\Program Files\Windows Defender\
      ModifyingApplication|endswith: \MsMpEng.exe
    - ApplicationPath|startswith:
        - C:\ProgramData\Microsoft\Windows Defender\Platform\
        - C:\Program Files\Windows Defender\
      ApplicationPath|endswith: \MsMpEng.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: medium
license: DRL-1.1
related:
  - id: cde0a575-7d3d-4a49-9817-b8004a7bf105
    type: derived