Windows Firewall Exception Rule Deletion (EventID 2006/2052)

title: Windows Firewall Exception Rule Deletion (EventID 2006/2052)
id: 9283468e-e1ce-4a69-bf62-86786111bda8
status: test
description: This rule identifies when a Windows Defender Firewall exception list rule is deleted, based on firewall-as events with EventID 2006 or 2052. Attackers may remove firewall rules to disable access controls, restore stealth, or disrupt defensive monitoring. It relies on Windows firewall telemetry that records rule deletions and captures the ModifyingApplication context for basic filtering.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2024-08-29
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2006
      - 2052
  filter_main_generic:
    ModifyingApplication|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\WinSxS\
  filter_main_svchost:
    ModifyingApplication: C:\Windows\System32\svchost.exe
  filter_optional_msmpeng:
    ModifyingApplication|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
    ModifyingApplication|endswith: \MsMpEng.exe
  filter_main_null:
    ModifyingApplication: null
  filter_main_empty:
    ModifyingApplication: ""
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: medium
license: DRL-1.1
related:
  - id: c187c075-bb3e-4c62-b4fa-beae0ffc211f
    type: derived