Windows Firewall Exception Rule Modified (Event IDs 2005, 2073)

title: Windows Firewall Exception Rule Modified (Event IDs 2005, 2073)
id: cd67e692-1872-4de4-afa1-d55cc9b4ecbb
status: test
description: This rule identifies modifications to entries in the Windows Defender Firewall exception list using firewall-as events with Event ID 2005 or 2073. Attackers can abuse firewall exceptions to permit inbound or otherwise restricted traffic, reducing the effectiveness of host-based network controls. Telemetry required is Windows firewall service events that report exception list rule changes, with optional exclusions for specific application paths (Teams, Keybase, Messenger, Opera, Brave).
references:
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/firewall_as/win_firewall_as_change_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2024-01-22
tags:
  - attack.defense-impairment
  - attack.t1686.003
  - detection.threat-hunting
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2005
      - 2073
  filter_optional_teams:
    ApplicationPath|endswith: \AppData\local\microsoft\teams\current\teams.exe
  filter_optional_keybase:
    ApplicationPath|endswith: \AppData\Local\Keybase\keybase.exe
  filter_optional_messenger:
    ApplicationPath|endswith: \AppData\Local\Programs\Messenger\Messenger.exe
  filter_optional_opera:
    ApplicationPath|contains|all:
      - :\Users\
      - \AppData\Local\Programs\Opera\
      - \opera.exe
  filter_optional_brave:
    ApplicationPath|contains|all:
      - :\Users\
      - \AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe
  condition: selection and not 1 of filter_optional_*
level: low
license: DRL-1.1
related:
  - id: 5570c4d9-8fdd-4622-965b-403a5a101aa0
    type: derived