Windows Registry: Disable Microsoft Defender Firewall by Setting EnableFirewall to 0

title: "Windows Registry: Disable Microsoft Defender Firewall by Setting EnableFirewall to 0"
id: 07813f72-32d2-4e13-926f-bf2164f156a8
status: test
description: This rule identifies Registry writes that target SharedAccess FirewallPolicy keys and set the EnableFirewall value to DWORD 0x00000000, disabling the firewall for Domain, Public, or Standard profiles. Disabling or weakening host firewalling can help attackers bypass network access restrictions and reduce the impact of security controls. It relies on registry set telemetry capturing TargetObject paths under the FirewallPolicy subtree and the Details value indicating the disable setting.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml
author: frack113, Huntrule Team
date: 2022-01-09
modified: 2024-03-25
tags:
  - attack.defense-impairment
  - attack.t1686.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Services\SharedAccess\Parameters\FirewallPolicy\
    TargetObject|endswith: \EnableFirewall
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/info.yml
simulation:
  - type: atomic-red-team
    name: Disable Microsoft Defender Firewall via Registry
    technique: T1562.004
    atomic_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612
license: DRL-1.1
related:
  - id: 974515da-6cc5-4c95-ae65-f97f9150ec7f
    type: derived