Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
12
12
7
Contributors
12
7
5
3
1
Categories
25
8
7
5
4
Platforms
20
8
3
1
Products / Services
11
7
4
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.
This detection identifies instances where a Windows Firewall rule is added by monitoring Event ID 4946 in the Windows Security Event Log. Firewall rule modifications can indicate legitimate administrative actions, but they may also signal unauthorized changes, misconfigurations, or malicious activity such as attackers allowing traffic for backdoors or persistence mechanisms. By analyzing fields like RuleName, RuleId, Computer, and ProfileChanged, security teams can determine whether the change aligns with expected behavior. Correlating with user activity and process execution can help distinguish false positives from real threats, ensuring better visibility into potential security risks.
Detects when a PowerShell script uses the 'New-NetFirewallRule' cmdlet to create a new firewall rule with an 'Allow' action. This activity can indicate an adversary attempting to bypass host-based firewalls to enable command and control, lateral movement, or data exfiltration.
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location. Adversaries may modify system firewalls to bypass controls limiting network usage, enabling C2 communications, lateral movement, and/or data exfiltration.
Detects when a rule has been modified in the Windows Firewall exception list. This can indicate an adversary attempting to bypass host-based firewall controls to enable command and control, lateral movement, or data exfiltration.
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
This rule detects when the Windows Defender Firewall service fails to load Group Policy. This event can indicate an issue with the firewall configuration being applied, potentially leading to a weakened security posture or unexpected network behavior. Adversaries might attempt to interfere with firewall policy loading to bypass defenses.
This rule detects when the Windows Defender Firewall configuration has been reset to its default settings. This action can indicate an attempt by an adversary to disable or modify firewall rules to bypass network controls, facilitate C2 communications, or enable lateral movement. It specifically looks for Event IDs 2032 (for most Windows versions) and 2060 (for Windows 11) from the firewall-as log source.
This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.
Page 2 of 2