Abuse of Microsoft Defender Firewall Registry Keys for Unauthorized Application Access

Attackers and malware, including historical samples like variants of Zbot, exploit the Windows Registry to modify Microsoft Defender Firewall configuration. By writing to the 'AuthorizedApplications\List' keys under 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy', an attacker can programmatically grant an arbitrary executable network access. This technique allows a malicious process to bypass firewall restrictions without user interaction or a formal interface prompt. Because these changes reside in the registry, they can persist across system reboots. This activity is a classic form of defense impairment, ensuring that command-and-control communication remains viable even when local network filtering policies would otherwise block the activity. Defenders should monitor registry write operations to the SharedAccess parameters hive to detect unauthorized changes to firewall exceptions.

Impact

Successful exploitation allows malicious binaries to bypass host-based network egress restrictions. This facilitates persistent command-and-control communications and exfiltration of sensitive data from the targeted host. These modifications are often seen in the context of trojans and spyware seeking to maintain stealthy network connectivity while evading detection by standard security policy configurations.

Recommendation

• Deploy the provided Sigma rule to monitor 'registry_set' events targeting 'FirewallPolicy' keys.
• Implement monitoring for processes creating or modifying registry keys under 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess'.
• Audit existing authorized application exceptions periodically to identify non-standard entries or orphaned application paths.