Add Authorized Applications to Microsoft Defender Firewall via Registry

experimentalmedium
log source: windows · registry_setauthor frack113date 2026-10-13
01

description

What this is, in brief.

Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.

02

tags

attack.defense-impairmentattack.t1686.003
03

rule source (YAML)

title: Add Authorized Applications to Microsoft Defender Firewall via Registry
id: 6648f900-4a7d-47e3-bad6-952b313a1c0e
status: experimental
description: |
    Detects the degradation of the system firewall security by the creation or re-enabling of per-application
    exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
    the targeted executable network access and can be abused by malware to bypass network restrictions.
references:
    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
    - https://www.greatis.com/appdata/d/q/qykernel.exe.htm
    - https://www.scanspyware.net/spyware-sub/spyware-removal/MarketScore-RelevantKnowledge
author: frack113
date: 2026-10-13
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\Services\SharedAccess\Parameters\FirewallPolicy\'
            - '\AuthorizedApplications\List'
        Details|contains: ':Enabled:'
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_defender_firewall_add_exception/info.yml
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.