Windows Firewall Service Failed to Load Group Policy (Event ID 2009)

Alert on Event ID 2009 when the Windows Defender Firewall service cannot load Group Policy.

FreeUnreviewedSigmalowv1

windows-firewall-service-failed-to-load-group-policy-event-id-2009-7ec15688

title: Windows Firewall Service Failed to Load Group Policy (Event ID 2009)
id: 4d1ba347-009d-4d89-b636-55c54d6ec8b3
status: test
description: This rule flags Windows events where the Windows Defender Firewall service fails to load Group Policy, indicated by Event ID 2009. Attackers can rely on policy misconfiguration or disruption to reduce host security enforcement and weaken defensive controls. The detection relies on Windows firewall service audit telemetry that records the specific policy-loading failure.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml
author: frack113, Huntrule Team
date: 2022-02-19
modified: 2023-01-17
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID: 2009
  condition: selection
level: low
license: DRL-1.1
related:
  - id: 7ec15688-fd24-4177-ba43-1a950537ee39
    type: derived

What it detects

This rule flags Windows events where the Windows Defender Firewall service fails to load Group Policy, indicated by Event ID 2009. Attackers can rely on policy misconfiguration or disruption to reduce host security enforcement and weaken defensive controls. The detection relies on Windows firewall service audit telemetry that records the specific policy-loading failure.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.