Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
19
Contributors
19
Categories
8
6
4
3
1
Platforms
19
Products / Services
12
7
7
4
1
MITRE Techniques
18,079
15,542
12,519
8,344
6,154
Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
Detects the degradation of the system firewall security by the creation or re-enabling of per-application
exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
the targeted executable network access and can be abused by malware to bypass network restrictions.
exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
the targeted executable network access and can be abused by malware to bypass network restrictions.
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE).
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".
Detects when a rule has been added to the Windows Firewall exception list
Detects activity when the settings of the Windows firewall have been changed
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.
Detects netsh commands that turns off the Windows firewall
Detects the addition of a new rule to the Windows firewall via netsh
Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall
Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware
Adversaries may modify system firewalls in order to bypass controls limiting network usage
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage
Detects activity when The Windows Defender Firewall service failed to load Group Policy
Detects activity when Windows Defender Firewall has been reset to its default configuration
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Detects when a user disables the Windows Firewall via a Profile to help evade defense.
Detects the removal of a port or application rule in the Windows Firewall configuration using netsh
Detect set EnableFirewall to 0 to disable the Windows firewall