Allow Exceptions in Microsoft Defender Firewall via Registry

experimentalmedium
log source: windows · registry_setauthor frack113date 2026-10-13
01

description

What this is, in brief.

Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft Defender Firewall and can restore network paths that a hardened profile would block.

02

tags

attack.defense-impairmentattack.t1686.003
03

rule source (YAML)

title: Allow Exceptions in Microsoft Defender Firewall via Registry
id: c69fc6a2-607d-4530-b7d1-75823af1bde4
status: experimental
description: |
    Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
    set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
    Defender Firewall and can restore network paths that a hardened profile would block.
references:
    - https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
    - https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
    - https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
author: frack113
date: 2026-10-13
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
        TargetObject|endswith: '\DoNotAllowExceptions'
        Details: 'DWORD (0x00000000)'
    filter_main_svchost:
        Image:
            - 'C:\Windows\System32\svchost.exe'
            - 'C:\Windows\SysWOW64\svchost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_defender_firewall_exceptions/info.yml
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.