Windows Firewall Rules Deleted (Windows Defender Firewall) via Firewall-as Events
Alerts on Windows Defender Firewall configurations where all rules are deleted (Event 2033/2059), signaling potential defense impairment.
- Product
- windows
- Service
- firewall-as
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-17
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows events indicating all rules have been deleted from the Windows Defender Firewall configuration on the host. Attackers may remove firewall rules to reduce network filtering and enable follow-on access. It relies on Windows Firewall-as event telemetry (Event IDs 2033 and 2059) and excludes cases where the modifying application matches svchost.exe or the MsMpEng.exe path used by system components.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Firewall Rules Deleted (Windows Defender Firewall) via Firewall-as Events
id: 022894a7-95d4-49a2-a567-9d2d1e4ebf39
status: test
description: This rule flags Windows events indicating all rules have been deleted from the Windows Defender Firewall configuration on the host. Attackers may remove firewall rules to reduce network filtering and enable follow-on access. It relies on Windows Firewall-as event telemetry (Event IDs 2033 and 2059) and excludes cases where the modifying application matches svchost.exe or the MsMpEng.exe path used by system components.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-17
modified: 2024-01-22
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
product: windows
service: firewall-as
detection:
selection:
EventID:
- 2033
- 2059
filter_main_svchost:
ModifyingApplication|endswith: :\Windows\System32\svchost.exe
filter_optional_msmpeng:
ModifyingApplication|contains|all:
- :\ProgramData\Microsoft\Windows Defender\Platform\
- \MsMpEng.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
level: high
license: DRL-1.1
related:
- id: 79609c82-a488-426e-abcf-9f341a39365d
type: derived