Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies registry writes that add or re-enable per-application firewall exceptions by targeting FirewallPolicy\AuthorizedApplications\List keys under the Services\SharedAccess\Parameters\FirewallPolicy path. Such changes matter because attackers can grant network access to a specific executable and weaken host network restrictions. The detection relies on registry set telemetry matching the targeted key paths and the presence of the ":Enabled:" value in the written data.

Reporting behind it

Related detections9 linkedT1686.003 — drag to rearrange

Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Windows Firewall Exception Rule Added for Application in Suspicious Path

Windows Firewall Rules Deleted (Windows Defender Firewall) via Firewall-as Events

Windows Registry: Disable Firewall via EnableFirewall DWORD Policies

Windows Firewall rule deleted via netsh.exe command line

Windows Firewall Settings Change Events (Windows Firewall/Defender Firewall-AS)

Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)

Windows Defender Firewall Service Failed to Load Group Policy (Event ID 2009)

Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

Pivot detection · T1686.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-authorizedapplications-list-enabled-firewall-exceptions-6648f900

title: "Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions"
id: 504ea540-4547-4f04-a279-dc03628c43fc
status: experimental
description: This rule identifies registry writes that add or re-enable per-application firewall exceptions by targeting FirewallPolicy\AuthorizedApplications\List keys under the Services\SharedAccess\Parameters\FirewallPolicy path. Such changes matter because attackers can grant network access to a specific executable and weaken host network restrictions. The detection relies on registry set telemetry matching the targeted key paths and the presence of the ":Enabled:" value in the written data.
references:
  - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
  - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
  - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
  - https://www.greatis.com/appdata/d/q/qykernel.exe.htm
  - https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception.yml
author: frack113, Huntrule Team
date: 2026-10-13
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \Services\SharedAccess\Parameters\FirewallPolicy\
      - \AuthorizedApplications\List
    Details|contains: ":Enabled:"
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception/info.yml
license: DRL-1.1
related:
  - id: 6648f900-4a7d-47e3-bad6-952b313a1c0e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL