Windows Registry: Disable Firewall via EnableFirewall DWORD Policies
Flags registry policy changes that set Windows Firewall EnableFirewall to 0 for Domain or Standard profiles.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-08-19
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches registry set events where the EnableFirewall policy DWORD is written with value 0x00000000 for the StandardProfile or DomainProfile Windows Firewall policies. Disabling firewall protections is a defense-impairment tactic that can make host and network traffic easier to access for an attacker. It relies on telemetry from registry set activity that records the target registry path and the DWORD value written.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Disable Firewall via EnableFirewall DWORD Policies"
id: 05adfbd6-1634-458d-b5db-4689d4c70280
status: test
description: This rule matches registry set events where the EnableFirewall policy DWORD is written with value 0x00000000 for the StandardProfile or DomainProfile Windows Firewall policies. Disabling firewall protections is a defense-impairment tactic that can make host and network traffic easier to access for an attacker. It relies on telemetry from registry set activity that records the target registry path and the DWORD value written.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.004/T1562.004.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_windows_firewall.yml
author: frack113, Huntrule Team
date: 2022-08-19
modified: 2023-08-17
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith:
- \SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\EnableFirewall
- \SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e78c408a-e2ea-43cd-b5ea-51975cf358c0
type: derived