Windows Firewall Disabled via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects when the Windows Firewall is disabled by setting the 'EnableFirewall' registry value to 0 (DWORD 0x00000000) for either the StandardProfile or DomainProfile. This action can be performed by adversaries to bypass network controls and facilitate malicious activity.