Detection of Unauthorized Windows Firewall Exception Rule Creation

This brief addresses the detection of unauthorized modifications to the Windows Defender Firewall exception list. Attackers often attempt to modify firewall rules to maintain persistence or establish inbound network communication for command-and-control (C2) infrastructure. By adding an exception rule for a malicious binary, an adversary can bypass security controls that would otherwise block their traffic.

Defenders should monitor Event IDs 2004, 2071, and 2097, which record the creation of new firewall rules. Because many legitimate applications and Windows services perform these actions, it is necessary to filter against known-good paths and trusted system binaries. This brief provides a detection logic to isolate modifications occurring outside of standard enterprise application paths or those performed by suspicious processes. Monitoring these events is a critical component of identifying defense impairment and lateral movement attempts.

Impact

Successful exploitation allows an attacker to open communication ports that bypass firewall restrictions, potentially enabling unhindered C2 communication or lateral movement between compromised hosts within an internal network. If not monitored, these rule modifications may remain undetected as a form of stealthy persistence.

Recommendation

• Deploy the Sigma rule below to monitor for firewall rule additions originating from suspicious paths or untrusted modifying applications.
• Baseline common administrative tools and deployment scripts in your environment to further reduce false positives before enabling alerting.
• Review Event ID 2004, 2071, and 2097 logs periodically to identify unusual network exceptions or rule additions occurring outside of standard maintenance windows.