Windows Firewall Exception List Rule Deletion via Windows Event 2006/2052
Flags deletion of Windows Defender Firewall exception rules using EventID 2006 or 2052 with modifying application context.
- Product
- windows
- Service
- firewall-as
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-19
- Updated
- 2026-10-21
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Defender Firewall exception list changes where firewall rules are deleted, using event IDs 2006 and 2052. Removing exception list rules can impair defensive connectivity and may be used to hinder or revert prior access allowances. The detection relies on Windows firewall auditing telemetry that records the deleting process via ModifyingApplication and the ModifyingUser context, while filtering common system and installer-related actors to reduce false positives.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-10-21
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall Exception List Rule Deletion via Windows Event 2006/2052
id: 9283468e-e1ce-4a69-bf62-86786111bda8
status: test
description: This rule identifies Windows Defender Firewall exception list changes where firewall rules are deleted, using event IDs 2006 and 2052. Removing exception list rules can impair defensive connectivity and may be used to hinder or revert prior access allowances. The detection relies on Windows firewall auditing telemetry that records the deleting process via ModifyingApplication and the ModifyingUser context, while filtering common system and installer-related actors to reduce false positives.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2026-10-19
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2006
- 2052
filter_main_generic:
ModifyingApplication|startswith:
- C:\Program Files (x86)\
- C:\Program Files\
- C:\Windows\WinSxS\
filter_main_local_system:
ModifyingUser: S-1-5-18
filter_main_msiexec:
ModifyingApplication:
- C:\Windows\SysWOW64\msiexec.exe
- C:\Windows\System32\msiexec.exe
filter_main_svchost:
ModifyingApplication: C:\Windows\System32\svchost.exe
filter_main_msmpeng:
ModifyingApplication|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
ModifyingApplication|endswith: \MsMpEng.exe
filter_main_null:
ModifyingApplication: null
filter_main_empty:
ModifyingApplication: ""
filter_optional_google_updater:
ModifyingApplication|startswith: C:\Windows\SystemTemp\
ModifyingApplication|contains: GoogleUpdater
ModifyingApplication|endswith: \setup.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: medium
license: DRL-1.1
related:
- id: c187c075-bb3e-4c62-b4fa-beae0ffc211f
type: derived