Add Authorized Applications to Microsoft Defender Firewall via Registry

experimentalmedium
Log-Quelle: windows · registry_setAutor frack113Datum 2026-10-13
01

Beschreibung

Was dies ist, in Kürze.

Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.

02

Tags

attack.defense-impairmentattack.t1686.003
03

Regelquelle (YAML)

title: Add Authorized Applications to Microsoft Defender Firewall via Registry
id: 6648f900-4a7d-47e3-bad6-952b313a1c0e
status: experimental
description: |
    Detects the degradation of the system firewall security by the creation or re-enabling of per-application
    exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
    the targeted executable network access and can be abused by malware to bypass network restrictions.
references:
    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
    - https://www.greatis.com/appdata/d/q/qykernel.exe.htm
    - https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
author: frack113
date: 2026-10-13
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\Services\SharedAccess\Parameters\FirewallPolicy\'
            - '\AuthorizedApplications\List'
        Details|contains: ':Enabled:'
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception/info.yml
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.