Allow Exceptions in Microsoft Defender Firewall via Registry

SIGMA detection rule by frack113 · Unknown

Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft Defender Firewall and can restore network paths that a hardened profile would block.

title: Allow Exceptions in Microsoft Defender Firewall via Registry
id: c69fc6a2-607d-4530-b7d1-75823af1bde4
status: experimental
description: |
    Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
    set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
    Defender Firewall and can restore network paths that a hardened profile would block.
references:
    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
    - https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
author: frack113
date: 2026-10-13
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
        TargetObject|endswith: '\DoNotAllowExceptions'
        Details: 'DWORD (0x00000000)'
    filter_main_svchost:
        Image:
            - 'C:\Windows\System32\svchost.exe'
            - 'C:\Windows\SysWOW64\svchost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions/info.yml

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ca5728f1-ea76-4320-98d1-c0ffb3f6ad3b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion