detection.wiki

Detection rules › Sigma

Firewall deactivation (firewall)

Status
experimental
Severity
high
Log source
product windows, service firewall-as
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker disabled the Windows Firewall to evade defense.

Known false positives

  • Administrator activity

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4950: A Windows Firewall setting has changed.
Windows-Firewall-With-Advanced-SecurityEvent ID 2003: A Windows Defender Firewall setting in the Profiles profile has changed.

Rule body

title: Firewall deactivation (firewall)
description: Detects scenarios where an attacker disabled the Windows Firewall to evade defense.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.004-Impair%20Defenses-Disable%20or%20Modify%20System%20Firewall
- https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: firewall-as
detection:
  selection_advanced: # Avanced ID provides the SID of the Subject User
    Channel: 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'
    EventID: 2003 # Firewall setting  has changed.
    SettingType: '1' # Enable Windows Firewall
    SettingValueString: 'No' # Enable Windows Firewall > No

  selection_basic:
    EventID: 4950 # MPSSVC Rule-Level Policy Change
    SettingType: 'Enable Windows Firewall'
    SettingValue: 'No' # Enable Windows Firewall
  condition: selection_advanced or selection_basic
falsepositives:
- Administrator activity
level: high

Stages and Predicates

Stage 0: condition

selection_advanced or selection_basic

Stage 1: selection_advanced

selection_advanced:
  Channel: 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'
  EventID: 2003
  SettingType: '1'
  SettingValueString: 'No'

Stage 2: selection_basic

selection_basic:
  EventID: 4950
  SettingType: 'Enable Windows Firewall'
  SettingValue: 'No'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
SettingTypeeq
  • 1
  • Enable Windows Firewall
field:"SettingType" kind:eq
SettingValueeq
  • No
field:"SettingValue" kind:eq value:"No"
SettingValueStringeq
  • No
field:"SettingValueString" kind:eq value:"No"