Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)
Alerts when DoNotAllowExceptions is set to 0 in the Defender Firewall policy registry path, re-enabling firewall exceptions.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2026-10-13
- Updated
- 2026-10-14
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry set activity that sets the DoNotAllowExceptions value to DWORD 0x00000000 under the Microsoft Defender Firewall policy path, effectively re-enabling application and port exceptions. Attackers and other unauthorized users may use this to weaken a hardened firewall stance and restore network paths that would otherwise be blocked. It relies on Windows registry set telemetry capturing the targeted key/value details, with exclusions for svchost.exe-launched changes to reduce noise.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
- app.any.runhttps://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
- zscaler.comhttps://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
- trendmicro.comhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)"
id: 7df00f69-1f3e-4b8a-a644-ce103a2bbc1d
status: experimental
description: This rule flags registry set activity that sets the DoNotAllowExceptions value to DWORD 0x00000000 under the Microsoft Defender Firewall policy path, effectively re-enabling application and port exceptions. Attackers and other unauthorized users may use this to weaken a hardened firewall stance and restore network paths that would otherwise be blocked. It relies on Windows registry set telemetry capturing the targeted key/value details, with exclusions for svchost.exe-launched changes to reduce noise.
references:
- https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
- https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
- https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions.yml
author: frack113, Huntrule Team
date: 2026-10-13
tags:
- attack.defense-impairment
- attack.t1686.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\SharedAccess\Parameters\FirewallPolicy\
TargetObject|endswith: \DoNotAllowExceptions
Details: DWORD (0x00000000)
filter_main_svchost:
Image:
- C:\Windows\System32\svchost.exe
- C:\Windows\SysWOW64\svchost.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions/info.yml
license: DRL-1.1
related:
- id: c69fc6a2-607d-4530-b7d1-75823af1bde4
type: derived