Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions
Flags registry updates that enable per-application Microsoft Defender Firewall exceptions via AuthorizedApplications\List.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2026-10-13
- Updated
- 2026-10-14
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry writes that add or re-enable per-application firewall exceptions by targeting FirewallPolicy\AuthorizedApplications\List keys under the Services\SharedAccess\Parameters\FirewallPolicy path. Such changes matter because attackers can grant network access to a specific executable and weaken host network restrictions. The detection relies on registry set telemetry matching the targeted key paths and the presence of the ":Enabled:" value in the written data.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
- app.any.runhttps://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
- trendmicro.comhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
- greatis.comhttps://www.greatis.com/appdata/d/q/qykernel.exe.htm
- scanspyware.nethttps://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions"
id: 504ea540-4547-4f04-a279-dc03628c43fc
status: experimental
description: This rule identifies registry writes that add or re-enable per-application firewall exceptions by targeting FirewallPolicy\AuthorizedApplications\List keys under the Services\SharedAccess\Parameters\FirewallPolicy path. Such changes matter because attackers can grant network access to a specific executable and weaken host network restrictions. The detection relies on registry set telemetry matching the targeted key paths and the presence of the ":Enabled:" value in the written data.
references:
- https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
- https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
- https://www.greatis.com/appdata/d/q/qykernel.exe.htm
- https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception.yml
author: frack113, Huntrule Team
date: 2026-10-13
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \Services\SharedAccess\Parameters\FirewallPolicy\
- \AuthorizedApplications\List
Details|contains: ":Enabled:"
condition: selection
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception/info.yml
license: DRL-1.1
related:
- id: 6648f900-4a7d-47e3-bad6-952b313a1c0e
type: derived