Windows Firewall rules deleted (Event ID 2033/2059) indicating defense impairment

title: Windows Firewall rules deleted (Event ID 2033/2059) indicating defense impairment
id: 022894a7-95d4-49a2-a567-9d2d1e4ebf39
status: test
description: This rule flags events where all Windows Defender Firewall rules are deleted from the local host (Event ID 2033 on Windows broadly and 2059 on Windows 11). Removing firewall rules can disable host network filtering and help an attacker reduce defensive controls. It relies on Windows firewall auditing telemetry that records the specific “all rules have been deleted” event IDs and filters out activity originating from the system firewall services context.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-17
modified: 2024-01-22
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID:
      - 2033
      - 2059
  filter_main_svchost:
    ModifyingApplication|endswith: :\Windows\System32\svchost.exe
  filter_optional_msmpeng:
    ModifyingApplication|contains|all:
      - :\ProgramData\Microsoft\Windows Defender\Platform\
      - \MsMpEng.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: high
license: DRL-1.1
related:
  - id: 79609c82-a488-426e-abcf-9f341a39365d
    type: derived