Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)
Flags Windows Defender Firewall exception list changes (Event IDs 2005/2073), indicating potential attacker-driven network access changes.
- Product
- windows
- Service
- firewall-as
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-19
- Updated
- 2026-07-31
What it detects
This rule identifies modification of Windows Defender Firewall exception list entries, based on firewall-as events with EventID 2005 (Windows 10) and 2073 (Windows 11). Attackers may change firewall exceptions to allow inbound/outbound access while bypassing host network controls. Telemetry relies on Windows firewall-as event logs that record when exception list rules are modified, optionally excluding certain application paths such as Teams, Keybase, Messenger, Opera, and Brave.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)
id: cd67e692-1872-4de4-afa1-d55cc9b4ecbb
status: test
description: This rule identifies modification of Windows Defender Firewall exception list entries, based on firewall-as events with EventID 2005 (Windows 10) and 2073 (Windows 11). Attackers may change firewall exceptions to allow inbound/outbound access while bypassing host network controls. Telemetry relies on Windows firewall-as event logs that record when exception list rules are modified, optionally excluding certain application paths such as Teams, Keybase, Messenger, Opera, and Brave.
references:
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/firewall_as/win_firewall_as_change_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2024-01-22
tags:
- attack.defense-impairment
- attack.t1686.003
- detection.threat-hunting
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2005
- 2073
filter_optional_teams:
ApplicationPath|endswith: \AppData\local\microsoft\teams\current\teams.exe
filter_optional_keybase:
ApplicationPath|endswith: \AppData\Local\Keybase\keybase.exe
filter_optional_messenger:
ApplicationPath|endswith: \AppData\Local\Programs\Messenger\Messenger.exe
filter_optional_opera:
ApplicationPath|contains|all:
- :\Users\
- \AppData\Local\Programs\Opera\
- \opera.exe
filter_optional_brave:
ApplicationPath|contains|all:
- :\Users\
- \AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe
condition: selection and not 1 of filter_optional_*
level: low
license: DRL-1.1
related:
- id: 5570c4d9-8fdd-4622-965b-403a5a101aa0
type: derived