Detection rules › By event

Microsoft-Windows-Windows-Firewall-With-Advanced-Security

Event	Rules
Event ID 2002	1
Event ID 2003	2
Event ID 2004	6
Event ID 2005	2
Event ID 2006	1
Event ID 2008	1
Event ID 2009	1
Event ID 2032	1
Event ID 2033	1
Event ID 2052	1
Event ID 2059	1
Event ID 2060	1
Event ID 2071	3
Event ID 2073	1
Event ID 2082	1
Event ID 2083	1
Event ID 2097	3

Event ID 2002

1 detection rules reference this event. View event page.

Sigma (1)

Windows Firewall Settings Have Been Changed severity low T1686, T1686.003

Event ID 2003

2 detection rules reference this event. View event page.

Sigma (2)

Firewall deactivation (firewall) severity high T1685, T1686
Windows Firewall Settings Have Been Changed severity low T1686, T1686.003

Event ID 2004

6 detection rules reference this event. View event page.

Sigma (6)

Firewall rule added using PowerShell or CMD severity medium T1685, T1686
Firewall rule any/any created severity high T1685, T1686
New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application severity high T1686, T1686.003
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE severity medium T1686, T1686.003
OpenSSH server firewall configuration on Windows (firewall) severity high T1685, T1686
Uncommon New Firewall Rule Added In Windows Firewall Exception List severity medium T1686, T1686.003

Event ID 2005

2 detection rules reference this event. View event page.

Sigma (2)

Firewall rule any/any created severity high T1685, T1686
Firewall Rule Modified In The Windows Firewall Exception List severity low T1686, T1686.003

Event ID 2006

1 detection rules reference this event. View event page.

Sigma (1)

A Rule Has Been Deleted From The Windows Firewall Exception List severity medium T1686, T1686.003

Event ID 2008

1 detection rules reference this event. View event page.

Sigma (1)

Windows Firewall Settings Have Been Changed severity low T1686, T1686.003

Event ID 2009

1 detection rules reference this event. View event page.

Sigma (1)

The Windows Defender Firewall Service Failed To Load Group Policy severity low T1686, T1686.003

Event ID 2032

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Firewall Has Been Reset To Its Default Configuration severity low T1686, T1686.003

Event ID 2033

1 detection rules reference this event. View event page.

Sigma (1)

All Rules Have Been Deleted From The Windows Firewall Configuration severity high T1686, T1686.003

Event ID 2052

1 detection rules reference this event. View event page.

Sigma (1)

A Rule Has Been Deleted From The Windows Firewall Exception List severity medium T1686, T1686.003

Event ID 2059

1 detection rules reference this event. View event page.

Sigma (1)

All Rules Have Been Deleted From The Windows Firewall Configuration severity high T1686, T1686.003

Event ID 2060

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Firewall Has Been Reset To Its Default Configuration severity low T1686, T1686.003

Event ID 2071

3 detection rules reference this event. View event page.

Sigma (3)

New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application severity high T1686, T1686.003
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE severity medium T1686, T1686.003
Uncommon New Firewall Rule Added In Windows Firewall Exception List severity medium T1686, T1686.003

Event ID 2073

1 detection rules reference this event. View event page.

Sigma (1)

Firewall Rule Modified In The Windows Firewall Exception List severity low T1686, T1686.003

Event ID 2082

1 detection rules reference this event. View event page.

Sigma (1)

Windows Firewall Settings Have Been Changed severity low T1686, T1686.003

Event ID 2083

1 detection rules reference this event. View event page.

Sigma (1)

Windows Firewall Settings Have Been Changed severity low T1686, T1686.003

Event ID 2097

3 detection rules reference this event. View event page.

Sigma (3)

New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application severity high T1686, T1686.003
New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE severity medium T1686, T1686.003
Uncommon New Firewall Rule Added In Windows Firewall Exception List severity medium T1686, T1686.003