Windows Registry: Disable Microsoft Defender Firewall by Setting EnableFirewall to 0
Flags Windows Registry changes that disable Defender firewall by setting EnableFirewall DWORD to 0.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-09
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Registry writes that target SharedAccess FirewallPolicy keys and set the EnableFirewall value to DWORD 0x00000000, disabling the firewall for Domain, Public, or Standard profiles. Disabling or weakening host firewalling can help attackers bypass network access restrictions and reduce the impact of security controls. It relies on registry set telemetry capturing TargetObject paths under the FirewallPolicy subtree and the Details value indicating the disable setting.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Disable Microsoft Defender Firewall by Setting EnableFirewall to 0"
id: 07813f72-32d2-4e13-926f-bf2164f156a8
status: test
description: This rule identifies Registry writes that target SharedAccess FirewallPolicy keys and set the EnableFirewall value to DWORD 0x00000000, disabling the firewall for Domain, Public, or Standard profiles. Disabling or weakening host firewalling can help attackers bypass network access restrictions and reduce the impact of security controls. It relies on registry set telemetry capturing TargetObject paths under the FirewallPolicy subtree and the Details value indicating the disable setting.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml
author: frack113, Huntrule Team
date: 2022-01-09
modified: 2024-03-25
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\SharedAccess\Parameters\FirewallPolicy\
TargetObject|endswith: \EnableFirewall
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/info.yml
simulation:
- type: atomic-red-team
name: Disable Microsoft Defender Firewall via Registry
technique: T1562.004
atomic_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612
license: DRL-1.1
related:
- id: 974515da-6cc5-4c95-ae65-f97f9150ec7f
type: derived