Disable Microsoft Defender Firewall via Registry

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•31

This rule detects attempts to disable the Microsoft Defender Firewall by modifying specific registry keys. It looks for changes to the 'EnableFirewall' DWORD value to '0x00000000' (disabled) within the FirewallPolicy profiles (DomainProfile, PublicProfile, StandardProfile) under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\.