sigmamediumHunting

Allow Exceptions in Microsoft Defender Firewall via Registry

Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft Defender Firewall and can restore network paths that a hardened profile would block.

MITRE ATT&CK

T1686.003

Detection Query

selection:
  TargetObject|contains: \Services\SharedAccess\Parameters\FirewallPolicy\
  TargetObject|endswith: \DoNotAllowExceptions
  Details: DWORD (0x00000000)
filter_main_svchost:
  Image:
    - C:\Windows\System32\svchost.exe
    - C:\Windows\SysWOW64\svchost.exe
condition: selection and not 1 of filter_main_*

Author

frack113

Created

2026-10-13

Data Sources

windowsRegistry Set Events

Platforms

windows

References

Tags

attack.defense-impairmentattack.t1686.003

Raw Content

title: Allow Exceptions in Microsoft Defender Firewall via Registry
id: c69fc6a2-607d-4530-b7d1-75823af1bde4
status: experimental
description: |
    Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
    set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
    Defender Firewall and can restore network paths that a hardened profile would block.
references:
    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
    - https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
author: frack113
date: 2026-10-13
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
        TargetObject|endswith: '\DoNotAllowExceptions'
        Details: 'DWORD (0x00000000)'
    filter_main_svchost:
        Image:
            - 'C:\Windows\System32\svchost.exe'
            - 'C:\Windows\SysWOW64\svchost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions/info.yml