Windows Firewall exception rule deleted (Windows Firewall/Defender) EventID 2006/2052
Flags deletion of Windows Defender Firewall exception rules using EventID 2006 or 2052 with modifying application context.
- Product
- windows
- Service
- firewall-as
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when one or all firewall rules are deleted from the Windows Defender Firewall exception list, based on EventID 2006 and 2052. Attackers may remove firewall exceptions to disrupt security monitoring or impede access to needed network paths. It relies on Windows firewall service telemetry that records rule deletion events and the originating ModifyingApplication path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall exception rule deleted (Windows Firewall/Defender) EventID 2006/2052
id: 9283468e-e1ce-4a69-bf62-86786111bda8
status: test
description: This rule identifies when one or all firewall rules are deleted from the Windows Defender Firewall exception list, based on EventID 2006 and 2052. Attackers may remove firewall exceptions to disrupt security monitoring or impede access to needed network paths. It relies on Windows firewall service telemetry that records rule deletion events and the originating ModifyingApplication path.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2024-08-29
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2006
- 2052
filter_main_generic:
ModifyingApplication|startswith:
- C:\Program Files (x86)\
- C:\Program Files\
- C:\Windows\WinSxS\
filter_main_svchost:
ModifyingApplication: C:\Windows\System32\svchost.exe
filter_optional_msmpeng:
ModifyingApplication|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
ModifyingApplication|endswith: \MsMpEng.exe
filter_main_null:
ModifyingApplication: null
filter_main_empty:
ModifyingApplication: ""
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: medium
license: DRL-1.1
related:
- id: c187c075-bb3e-4c62-b4fa-beae0ffc211f
type: derived