Query: Sigma YAML for windows / firewall-as
Matching passage: Sigma rule: Detects when a rule has been added to the Windows Firewall exception list. Logsource: windows / firewall-as. Rule: title: Uncommon New Firewall Rule Added In Windows Firewall Exception List id: cde0a575-7d3d-4a49-9817-b8004a7bf105 status: test description: Detects when a rule has been added to the Windows Firewall exception list references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2025-10-08 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 filter_main_block: Action: 2 filter_main_generic: ApplicationPath|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_covered_paths: ApplicationPath|contains: - C:\PerfLogs\ - C:\Temp\ - C:\Tmp\ - C:\Users\Public\ - C:\Windows\Tasks\ - C:\Windows\Temp\ - \AppData\Local\Temp\ filter_main_system_dllhost: ApplicationPath: System ModifyingApplication: C:\Windows\System32\dllhost.exe filter_main_tiworker: ModifyingApplication|startswith: C:\Windows\WinSxS\ ModifyingApplication|endswith: \TiWorker.exe filter_main_null: ApplicationPath: null filter_optional_no_path: ModifyingApplication: - C:\Windows\System32\svchost.exe - C:\Windows\System32\dllhost.exe ApplicationPath: '' filter_optional_msmpeng: - ModifyingApplication|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ModifyingApplication|endswith: \MsMpEng.exe - ApplicationPath|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ApplicationPath|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: medium
Near-miss passage: Sigma rule: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by. Logsource: windows / process_creation. Rule: title: Boot Configuration Tampering Via Bcdedit.EXE id: 1444443e-6757-43e4-9ea4-c8fc705f79a2 status: stable description: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_set: CommandLine|contains: set selection_cli: - CommandLine|contains|all: - bootstatuspolicy - ignoreallfailures - CommandLine|contains|all: - recoveryenabled - 'no' condition: all of selection_* falsepositives: - Unlikely level: high simulation: - type: atomic-red-team name: Windows - Disable Windows Recovery Console Repair technique: T1490 atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81