Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)

title: Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)
id: cd67e692-1872-4de4-afa1-d55cc9b4ecbb
status: test
description: This rule identifies modification of Windows Defender Firewall exception list entries, based on firewall-as events with EventID 2005 (Windows 10) and 2073 (Windows 11). Attackers may change firewall exceptions to allow inbound/outbound access while bypassing host network controls. Telemetry relies on Windows firewall-as event logs that record when exception list rules are modified, optionally excluding certain application paths such as Teams, Keybase, Messenger, Opera, and Brave.
references:
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/firewall_as/win_firewall_as_change_rule.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2024-01-22
tags:
  - attack.defense-impairment
  - attack.t1686.003
  - detection.threat-hunting
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2005
      - 2073
  filter_optional_teams:
    ApplicationPath|endswith: \AppData\local\microsoft\teams\current\teams.exe
  filter_optional_keybase:
    ApplicationPath|endswith: \AppData\Local\Keybase\keybase.exe
  filter_optional_messenger:
    ApplicationPath|endswith: \AppData\Local\Programs\Messenger\Messenger.exe
  filter_optional_opera:
    ApplicationPath|contains|all:
      - :\Users\
      - \AppData\Local\Programs\Opera\
      - \opera.exe
  filter_optional_brave:
    ApplicationPath|contains|all:
      - :\Users\
      - \AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe
  condition: selection and not 1 of filter_optional_*
level: low
license: DRL-1.1
related:
  - id: 5570c4d9-8fdd-4622-965b-403a5a101aa0
    type: derived