Impairment of Microsoft Defender Firewall via Registry Modification

Threat actors have been observed modifying the Windows Registry to weaken system security posture by disabling restrictions on Microsoft Defender Firewall exceptions. By setting the 'DoNotAllowExceptions' value to '0' (DWORD 0x00000000) under the 'Services\SharedAccess\Parameters\FirewallPolicy' registry hive, an attacker can bypass existing firewall policies that normally block unsolicited inbound or outbound traffic. This technique is frequently employed by various malware strains, including Zbot variants, to maintain persistence or open communication channels that would otherwise be restricted by a hardened security profile. Security teams should monitor for unauthorized registry modifications targeting this path, particularly when the modification originates from processes other than legitimate Windows service hosts.

Impact

Successful exploitation allows attackers to bypass network security controls, facilitating the establishment of command-and-control channels or unauthorized lateral movement within the environment. This activity is often associated with malware that aims to disable local security features, thereby increasing the risk of data exfiltration and further payload delivery.

Recommendation

• Deploy the provided Sigma rule to monitor for unauthorized modifications to the 'DoNotAllowExceptions' registry key.
• Implement a policy of least privilege to restrict non-administrative users and suspicious processes from modifying registry keys under 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess'.
• Baseline legitimate software installation processes that may require firewall exceptions to ensure they do not perform this specific registry modification outside of defined maintenance windows.