Sample rules
Windows Firewall Rule Modification
- source: splunk
- technicques:
- T1562.004
Description
This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.
Detection logic
`wineventlog_security` EventCode=4947
| stats count min(_time) as firstTime max(_time) as lastTime by RuleName signature subject status dest ProcessID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_firewall_rule_modification_filter`
Windows Firewall Rule Added
- source: splunk
- technicques:
- T1562.004
Description
This detection identifies instances where a Windows Firewall rule is added by monitoring Event ID 4946 in the Windows Security Event Log. Firewall rule modifications can indicate legitimate administrative actions, but they may also signal unauthorized changes, misconfigurations, or malicious activity such as attackers allowing traffic for backdoors or persistence mechanisms. By analyzing fields like RuleName, RuleId, Computer, and ProfileChanged, security teams can determine whether the change aligns with expected behavior. Correlating with user activity and process execution can help distinguish false positives from real threats, ensuring better visibility into potential security risks.
Detection logic
`wineventlog_security` EventCode=4946
| stats count min(_time) as firstTime max(_time) as lastTime by RuleName signature subject status dest ProcessID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_firewall_rule_added_filter`