Add Authorized Applications to Microsoft Defender Firewall via Registry

Title: Add Authorized Applications to Microsoft Defender Firewall via Registry
Status: experimental
Description:Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.
References:
  -https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
  -https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
  -https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
  -https://www.greatis.com/appdata/d/q/qykernel.exe.htm
  -https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
Author: frack113
Date: 2026-10-13
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains|all:
      -'\Services\SharedAccess\Parameters\FirewallPolicy\'
      -'\AuthorizedApplications\List'

    Details|contains: ':Enabled:'
  condition:selection
Falsepositives:
  -Unknown
Level: medium