huntrule

Windows Firewall Exception List Rule Deletion via Windows Event 2006/2052

Flags deletion of Windows Defender Firewall exception rules using EventID 2006 or 2052 with modifying application context.

FreeReviewedSigma · Medium · v4
Product
windows
Service
firewall-as
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-02-19
Updated
2026-10-21
AnalysisDetection
title: Windows Firewall Exception List Rule Deletion via Windows Event 2006/2052
id: 9283468e-e1ce-4a69-bf62-86786111bda8
status: test
description: This rule identifies Windows Defender Firewall exception list changes where firewall rules are deleted, using event IDs 2006 and 2052. Removing exception list rules can impair defensive connectivity and may be used to hinder or revert prior access allowances. The detection relies on Windows firewall auditing telemetry that records the deleting process via ModifyingApplication and the ModifyingUser context, while filtering common system and installer-related actors to reduce false positives.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2026-10-19
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2006
      - 2052
  filter_main_generic:
    ModifyingApplication|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\WinSxS\
  filter_main_local_system:
    ModifyingUser: S-1-5-18
  filter_main_msiexec:
    ModifyingApplication:
      - C:\Windows\SysWOW64\msiexec.exe
      - C:\Windows\System32\msiexec.exe
  filter_main_svchost:
    ModifyingApplication: C:\Windows\System32\svchost.exe
  filter_main_msmpeng:
    ModifyingApplication|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
    ModifyingApplication|endswith: \MsMpEng.exe
  filter_main_null:
    ModifyingApplication: null
  filter_main_empty:
    ModifyingApplication: ""
  filter_optional_google_updater:
    ModifyingApplication|startswith: C:\Windows\SystemTemp\
    ModifyingApplication|contains: GoogleUpdater
    ModifyingApplication|endswith: \setup.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: medium
license: DRL-1.1
related:
  - id: c187c075-bb3e-4c62-b4fa-beae0ffc211f
    type: derived