Windows Firewall Exception List Rule Deletion

The deletion of Windows Firewall rules is a common technique used by threat actors to perform defense impairment. By removing existing rules, attackers can disable inbound or outbound traffic filtering that would otherwise block their command and control (C2) communication or lateral movement activities. This behavior can be identified by monitoring Windows Defender Firewall events for rule deletion triggers, specifically Event IDs 2006 and 2052. Defenders should focus on rule modifications initiated by processes not associated with trusted system services or legitimate administrative installation processes.

Attack Chain

1. An attacker gains elevated execution privileges on a target Windows host.
2. The attacker identifies restrictive firewall rules that impede their desired network traffic.
3. The attacker executes a command or script using tools like netsh.exe or PowerShell to modify the firewall configuration.
4. The attacker deletes the target firewall rule from the Windows Defender Firewall exception list.
5. The Windows security event log captures the modification (Event IDs 2006 or 2052).
6. The firewall becomes permissive for the previously blocked traffic.
7. The attacker establishes unauthorized network connections to an external C2 server or internal target.

Impact

Successful defense impairment through firewall rule deletion leaves systems exposed to unauthorized inbound access and allows malicious outbound traffic that would otherwise be blocked. This activity is typically a precursor to data exfiltration, payload delivery, or lateral movement within the network.

Recommendation

• Deploy the provided Sigma rule to detect suspicious deletion of firewall rules by unauthorized processes.
• Baseline legitimate software installers and administrative tasks that modify the firewall to tune out false positives.
• Review Event ID 2006 and 2052 logs regularly to identify non-standard firewall modifications.