Uncommon New Firewall Rule Added In Windows Firewall Exception List

Title: Uncommon New Firewall Rule Added In Windows Firewall Exception List
Status: test
Description:Detects when a rule has been added to the Windows Firewall exception list
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Author: frack113
Date: 2022-02-19
modified:2026-08-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'

Logsource:

• product: windows
• service: firewall-as

Detection:
  selection:
    EventID:
      -'2004'
      -'2071'
      -'2097'

  filter_main_block:
    Action: '2'
  filter_main_generic:
    ApplicationPath|startswith:
      -'C:\Program Files (x86)\'
      -'C:\Program Files\'
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'
      -'C:\Windows\WinSxS\'

  filter_main_covered_paths:
    ApplicationPath|contains:
      -'C:\PerfLogs\'
      -'C:\Temp\'
      -'C:\Tmp\'
      -'C:\Users\Public\'
      -'C:\Windows\Tasks\'
      -'C:\Windows\Temp\'
      -'\AppData\Local\Temp\'

  filter_main_system:
    ApplicationPath: 'SYSTEM'
    ModifyingApplication:
      -'C:\Windows\System32\dllhost.exe'
      -'C:\Windows\System32\oobe\Setup.exe'
      -'C:\Windows\System32\svchost.exe'

  filter_main_ehome:
    ApplicationPath|startswith: 'C:\Windows\ehome\'
    ModifyingApplication: 'C:\Windows\System32\oobe\Setup.exe'
  filter_main_tiworker:
    ModifyingApplication|startswith: 'C:\Windows\WinSxS\'
    ModifyingApplication|endswith: '\TiWorker.exe'
  filter_main_null:
    ApplicationPath: 'None'
  filter_optional_no_path:
    ModifyingApplication:
      -'C:\Windows\System32\svchost.exe'
      -'C:\Windows\System32\dllhost.exe'

    ApplicationPath: ''
  filter_optional_msmpeng:
    - ModifyingApplication|startswith:
      - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
      - 'C:\Program Files\Windows Defender\'
ModifyingApplication|endswith:'\MsMpEng.exe'     - ApplicationPath|startswith:
      - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
      - 'C:\Program Files\Windows Defender\'
ApplicationPath|endswith:'\MsMpEng.exe'   filter_optional_systemApps:
    ApplicationPath|startswith: 'C:\Windows\SystemApps\'
    ModifyingApplication: 'C:\Windows\System32\svchost.exe'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
Level: medium