New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application

Title: New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
Status: test
Description:Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  -https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
Author: frack113
Date: 2023-02-26
modified:2024-05-10
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'

Logsource:

• product: windows
• service: firewall-as

Detection:
  selection:
    EventID:
      -'2004'
      -'2071'
      -'2097'

    ApplicationPath|contains:
      -':\PerfLogs\'
      -':\Temp\'
      -':\Tmp\'
      -':\Users\Public\'
      -':\Windows\Tasks\'
      -':\Windows\Temp\'
      -'\AppData\Local\Temp\'

  filter_main_block:
    Action: '2'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high