Potential Endpoint Security Evasion via FirewallRules

[rule]
description = """
Identifies attempts to create custom Windows Firewall rules to block traffic originating from Endpoint security file
paths. Such actions could aid an adversary in evading the transmission of alerts and telemetry to the server side.
"""
id = "7cfc9edd-d180-43ba-a1d4-7f2eb4285787"
license = "Elastic License v2"
name = "Potential Endpoint Security Evasion via FirewallRules"
os_list = ["windows"]
reference = [
    "https://medium.com/csis-techblog/silencing-microsoft-defender-for-endpoint-using-firewall-rules-3839a8bf8d18",
]
version = "1.0.4"

query = '''
registry where 
 registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" and 
 registry.data.strings : ("*Block*App*\\Elastic\\*", 
                          "*Block*App*\\Windows Defender Advanced Threat Protection\\*", 
                          "*Block*App*\\CrowdStrike\\*", 
                          "*Block*App*\\SentinelOne\\*", 
                          "*Block*App*\\Palo Alto Networks\\*")
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"