huntrule

Windows Registry: Disable Firewall via EnableFirewall DWORD Policies

Flags registry policy changes that set Windows Firewall EnableFirewall to 0 for Domain or Standard profiles.

FreeUnreviewedSigmamediumv1
title: "Windows Registry: Disable Firewall via EnableFirewall DWORD Policies"
id: 05adfbd6-1634-458d-b5db-4689d4c70280
status: test
description: This rule matches registry set events where the EnableFirewall policy DWORD is written with value 0x00000000 for the StandardProfile or DomainProfile Windows Firewall policies. Disabling firewall protections is a defense-impairment tactic that can make host and network traffic easier to access for an attacker. It relies on telemetry from registry set activity that records the target registry path and the DWORD value written.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.004/T1562.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_windows_firewall.yml
author: frack113, Huntrule Team
date: 2022-08-19
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\EnableFirewall
      - \SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e78c408a-e2ea-43cd-b5ea-51975cf358c0
    type: derived

What it detects

This rule matches registry set events where the EnableFirewall policy DWORD is written with value 0x00000000 for the StandardProfile or DomainProfile Windows Firewall policies. Disabling firewall protections is a defense-impairment tactic that can make host and network traffic easier to access for an attacker. It relies on telemetry from registry set activity that records the target registry path and the DWORD value written.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.