Message

The following settings were applied to the Windows Defender Firewall at startup

	Current Profile:	%1
	IPsec SA Idle time:	%2
	IPsec preshared key encoding:	%3
	IPsec Exempt:	%4
	IPsec CRL Check:	%5
	IPsec Through NAT:	%6
	Policy Version Supported:	%7
	Policy Version:	%8
	Binary Version Supported:	%9
	Stateful FTP:	%10
	Group Policy Applied:	%11
	Remote Machine Authorization List:	%12
	Remote UserAuthorization List:	%13

Fields

Message

The following per profile settings were applied by Windows Defender Firewall 

	Profile:	%1
	Operational Mode:	%2
	Stealth Mode:	%3
	Block all Incoming Connections:	%4
	Unicast response to multicast broadcast:	%5
	Log dropped packets:	%6
	Log successful connections:	%7
	Log ignored rules:	%8
	Inbound Notifications:	%9
	Allow Local Policy Merge:	%12
	Allow Local IPsec Policy Merge:	%13
	Default Outbound Action:	%14
	Default Inbound Action:	%15
	Remote Administration:	%16
	Stealth Mode IPsec Secured Packet Exemption:	%21
	Maximum Log file size:	%17
	Log File path:	%18
	Allow User preferred merge of Authorized Applications:	%10
	Allow User preferred merge of Globally open ports:	%11

Fields

Message

A Windows Defender Firewall setting has changed.

New Setting:
	Type:	%1
	Value:	%4
	Modifying User:	%6
	Modifying Application:	%7

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2002
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:00:02.923110+00:00'
  event_record_id: 290
  correlation: {}
  execution:
    process_id: 1212
    thread_id: 2276
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-19
event_data:
  SettingType: 2
  SettingValueSize: 4
  SettingValue: '01000000'
  SettingValueDisplay: (null)
  Origin: 1
  ModifyingUser: S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052
  ModifyingApplication: ''
message: ''

Sigma Rules

• Windows Firewall Settings Have Been Changed
  Detects activity when the settings of the Windows firewall have been changed

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A Windows Defender Firewall setting in the %1 profile has changed.
New Setting:
	Type:	%2
	Value:	%5
	Modifying User:	%7
	Modifying Application:	%8

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: '{D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85}'
  event_source_name: ''
  event_id: 2003
  version: '0'
  level: '4'
  task: '0'
  opcode: '0'
  keywords: 9223372036854775808
  time_created: '2021-06-03T19:39:52.893086100Z'
  event_record_id: '912'
  correlation: {}
  execution:
    process_id: '1000'
    thread_id: '5464'
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: fs01.offsec.lan
  security:
    user_id: S-1-5-19
event_data:
  Profiles: '1'
  SettingType: '1'
  SettingValueSize: '4'
  SettingValue: '01000000'
  SettingValueString: 'Yes'
  Origin: '1'
  ModifyingUser: S-1-5-21-4230534742-2542757381-3142984815-1111
  ModifyingApplication: C:\Windows\System32\wbem\WmiPrvSE.exe

Sigma Rules

• Windows Firewall Settings Have Been Changed
  Detects activity when the settings of the Windows firewall have been changed

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

A rule has been added to the Windows Defender Firewall exception list.

Added Rule:
	Rule ID:	%1
	Rule Name:	%2
	Origin:	%3
	Active:	%18
	Direction:	%6
	Profiles:	%11
	Action:	%10
	Application Path:	%4
	Service Name:	%5
	Protocol:	%7
	Security Options:	%21
	Edge Traversal:	%19
	Modifying User:	%22
	Modifying Application:	%23

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2004
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223374235878031360
  time_created: '2022-04-07T17:06:55.849451+00:00'
  event_record_id: 173
  correlation: {}
  execution:
    process_id: 1928
    thread_id: 5436
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: S-1-5-19
event_data:
  RuleId: ADDS-NB-Datagram-UDP-In
  RuleName: Active Directory Domain Controller - NetBIOS name resolution (UDP-In)
  Origin: 1
  ApplicationPath: System
  ServiceName: ''
  Direction: 1
  Protocol: 17
  LocalPorts: '138'
  RemotePorts: '*'
  Action: 3
  Profiles: 2147483647
  LocalAddresses: '*'
  RemoteAddresses: '*'
  RemoteMachineAuthorizationList: ''
  RemoteUserAuthorizationList: ''
  EmbeddedContext: '@FirewallAPI.dll,-37601'
  Flags: 1
  Active: 1
  EdgeTraversal: 0
  LooseSourceMapped: 0
  SecurityOptions: 0
  ModifyingUser: S-1-5-18
  ModifyingApplication: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\TiWorker.exe
  SchemaVersion: 543
  RuleStatus: 65536
  LocalOnlyMapped: 0
message: ''

Sigma Rules

• Uncommon New Firewall Rule Added In Windows Firewall Exception List
  Detects when a rule has been added to the Windows Firewall exception list
• New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
  Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.
• New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
  Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

References

• Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd364408(v=ws.10)
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A rule has been modified in the Windows Defender Firewall exception list.

Modified Rule:
	Rule ID:	%1
	Rule Name:	%2
	Origin:	%3
	Active:	%18
	Direction:	%6
	Profiles:	%11
	Action:	%10
	Application Path:	%4
	Service Name:	%5
	Protocol:	%7
	Security Options:	%21
	Edge Traversal:	%19
	Modifying User:	%22
	Modifying Application:	%23

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2005
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223374235878031360
  time_created: '2022-04-07T17:07:00.091207+00:00'
  event_record_id: 189
  correlation: {}
  execution:
    process_id: 1928
    thread_id: 1948
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: S-1-5-19
event_data:
  RuleId: FPS-SpoolSvc-In-TCP
  RuleName: File and Printer Sharing (Spooler Service - RPC)
  Origin: 1
  ApplicationPath: C:\Windows\system32\spoolsv.exe
  ServiceName: Spooler
  Direction: 1
  Protocol: 6
  LocalPorts: RPC
  RemotePorts: '*'
  Action: 3
  Profiles: 7
  LocalAddresses: '*'
  RemoteAddresses: '*'
  RemoteMachineAuthorizationList: ''
  RemoteUserAuthorizationList: ''
  EmbeddedContext: '@FirewallAPI.dll,-28502'
  Flags: 1
  Active: 1
  EdgeTraversal: 0
  LooseSourceMapped: 0
  SecurityOptions: 0
  ModifyingUser: S-1-5-18
  ModifyingApplication: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\TiWorker.exe
  SchemaVersion: 543
  RuleStatus: 65536
  LocalOnlyMapped: 0
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A rule has been deleted in the Windows Defender Firewall exception list.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2006
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223374235878031360
  time_created: '2022-04-04T08:05:47.030869+00:00'
  event_record_id: 275
  correlation: {}
  execution:
    process_id: 1320
    thread_id: 5056
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WIN-TKC15D7KHUR
  security:
    user_id: S-1-5-19
event_data:
  RuleId: '{731057A4-5875-4405-ACE3-4C0DD0043413}'
  RuleName: WinDefend Outbound for TCP
  ModifyingUser: S-1-5-18
  ModifyingApplication: C:\Program Files\Windows Defender\MsMpEng.exe
message: ''

Sigma Rules

• A Rule Has Been Deleted From The Windows Firewall Exception List
  Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A rule has been listed when the Windows Defender Firewall started.

Added Rule:
	Rule ID:	%1
	Rule Name:	%2
	Origin:	%3
	Active:	%18
	Direction:	%6
	Profiles:	%11
	Action:	%10
	Application Path:	%4
	Service Name:	%5
	Protocol:	%7
	Security Options:	%21
	Edge Traversal:	%19

Fields

Message

Windows Defender Firewall Group Policy settings have changed. The new settings have been applied

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2008
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-05T23:50:01.847874+00:00'
  event_record_id: 1250
  correlation: {}
  execution:
    process_id: 2896
    thread_id: 9248
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data: {}
message: ''

Sigma Rules

• Windows Firewall Settings Have Been Changed
  Detects activity when the settings of the Windows firewall have been changed

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The Windows Defender Firewall service failed to load Group Policy.
Error:	%1

Fields

Sigma Rules

• The Windows Defender Firewall Service Failed To Load Group Policy
  Detects activity when The Windows Defender Firewall service failed to load Group Policy

Message

Network profile changed on an interface.

Adapter GUID:	%1
Adapter Name:	%2
Old Profile:	%3
New Profile:	%4

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2010
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T06:25:51.427999+00:00'
  event_record_id: 719
  correlation: {}
  execution:
    process_id: 3344
    thread_id: 3844
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  InterfaceGuid: 8E4162AD-6500-4899-BA95-24051405E207
  InterfaceName: ethernet_32769
  OldProfile: 2147483649
  NewProfile: 4
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Windows Defender Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Reason:		%1
Application Path:	%2
IP Version:	%3
Protocol:	%4
Port:		%5
Process Id:	%6
User:		%7

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2011
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T08:12:17.921409+00:00'
  event_record_id: 258
  correlation: {}
  execution:
    process_id: 1928
    thread_id: 2428
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: S-1-5-19
event_data:
  ReasonCode: 64
  ApplicationPath: C:\windows\system32\dns.exe
  IPVersion: 1
  Protocol: 17
  Port: 53
  ProcessId: 2208
  ModifyingUser: S-1-5-18
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A connection security rule was added to IPsec settings.

	Rule ID:	%1
	Rule Name:	%2
	Origin:	%3
	Active:	%4
	Protocol:	%5
	EndPoint1Ports:	%6
	EndPoint2Ports:	%7
	LocalTunnelEndpointV4:	%8
	LocalTunnelEndpointV6:	%9
	RemoteTunnelEndpointV4:	%10
	RemoteTunnelEndpointV6:	%11
	Phase1AuthSetId:	%12
	Phase2AuthSetId:	%13
	Phase2CryptoSetId:	%14
	Action:	%15
	Profiles:	%16
	LocalAddresses:	%17
	RemoteAddresses:	%18
	EmbeddedContext:	%20
	IsDTM:	%22
	ApplyAuthZ:	%23
	BypassTunnelIfEncrypted:	%24
	NoIPSecOnOutbound:	%25
	ModifyingUser:	%26
	ModifyingApplication:	%27

Fields

Message

A connection security rule was modified in IPsec settings.

	Rule ID:	%1
	Rule Name:	%2
	Origin:	%3
	Active:	%4
	Protocol:	%5
	EndPoint1Ports:	%6
	EndPoint2Ports:	%7
	LocalTunnelEndpointV4:	%8
	LocalTunnelEndpointV6:	%9
	RemoteTunnelEndpointV4:	%10
	RemoteTunnelEndpointV6:	%11
	Phase1AuthSetId:	%12
	Phase2AuthSetId:	%13
	Phase2CryptoSetId:	%14
	Action:	%15
	Profiles:	%16
	LocalAddresses:	%17
	RemoteAddresses:	%18
	EmbeddedContext:	%20
	IsDTM:	%22
	ApplyAuthZ:	%23
	BypassTunnelIfEncrypted:	%24
	NoIPSecOnOutbound:	%25
	ModifyingUser:	%26
	ModifyingApplication:	%27

Fields

Message

A connection security rule was deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4

Fields

Message

A connection security rule was added to IPsec settings when Windows Defender Firewall started.

	Rule ID:	%1
	Rule Name:	%2
	Origin:	%3
	Active:	%4
	Protocol:	%5
	EndPoint1Ports:	%6
	EndPoint2Ports:	%7
	LocalTunnelEndpointV4:	%8
	LocalTunnelEndpointV6:	%9
	RemoteTunnelEndpointV4:	%10
	RemoteTunnelEndpointV6:	%11
	Phase1AuthSetId:	%12
	Phase2AuthSetId:	%13
	Phase2CryptoSetId:	%14
	Action:	%15
	Profiles:	%16
	LocalAddresses:	%17
	RemoteAddresses:	%18
	EmbeddedContext:	%20
	IsDTM:	%22
	ApplyAuthZ:	%23
	BypassTunnelIfEncrypted:	%24
	NoIPSecOnOutbound:	%25
	ModifyingUser:	%26
	ModifyingApplication:	%27

Fields

Message

A main mode rule has been added in the IPsec settings.

	Rule ID:	%1
	Rule Name:	%2
	Profiles:	%3
	Endpoint1:	%4
	Endpoint2:	%5
	Phase1AuthSetId:	%6
	Phase1CryptoSetId:	%7
	Flags:	%8
	Active:	%9
	EmbeddedContext:	%10
	Origin:	%11
	ModifyingUser:	%12
	ModifyingApplication:	%13

Fields

Message

A main mode rule has been modified in the IPsec settings.

	Rule ID:	%1
	Rule Name:	%2
	Profiles:	%3
	Endpoint1:	%4
	Endpoint2:	%5
	Phase1AuthSetId:	%6
	Phase1CryptoSetId:	%7
	Flags:	%8
	Active:	%9
	EmbeddedContext:	%10
	Origin:	%11
	ModifyingUser:	%12
	ModifyingApplication:	%13

Fields

Message

A main mode rule has been deleted in the IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4

Fields

Message

A main mode rule was added to the IPsec settings when Windows Defender Firewall started.

	Rule ID:	%1
	Rule Name:	%2
	Profiles:	%3
	Endpoint1:	%4
	Endpoint2:	%5
	Phase1AuthSetId:	%6
	Phase1CryptoSetId:	%7
	Flags:	%8
	Active:	%9
	EmbeddedContext:	%10
	Origin:	%11
	ModifyingUser:	%12
	ModifyingApplication:	%13

Fields

Message

A phase 1 crypto set was added to IPsec settings.

	Set ID:	%1
	Set Name:	%2
	Origin:	%4
	Flags:	%6
	NumSuites:	%7
	TimeOutMinutes:	%10
	TimeOutSessions:	%11
	ModifyingUser:	%12
	ModifyingApplication:	%13

Fields

Message

A phase 1 crypto set was modified in IPsec settings.

	Set ID:	%1
	Set Name:	%2
	Origin:	%4
	Flags:	%6
	NumSuites:	%7
	TimeOutMinutes:	%10
	TimeOutSessions:	%11
	ModifyingUser:	%12
	ModifyingApplication:	%13

Fields

Message

A phase 1 crypto set was deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4

Fields

Message

A phase 1 crypto set was added to IPsec settings when Windows Defender Firewall started.

	Set ID:	%1
	Set Name:	%2
	Origin:	%4
	Flags:	%6
	NumSuites:	%7
	TimeOutMinutes:	%10
	TimeOutSessions:	%11
	ModifyingUser:	%12
	ModifyingApplication:	%13

Fields

Message

A phase 2 crypto set was added to IPsec settings.

	Set ID:	%1
	Set Name:	%2
	Origin:	%4
	Pfs:	%6
	NumSuites:	%7
	ModifyingUser:	%10
	ModifyingApplication:	%11

Fields

Message

A phase 2 crypto set was modified in IPsec settings.

	Set ID:	%1
	Set Name:	%2
	Origin:	%4
	Pfs:	%6
	NumSuites:	%7
	ModifyingUser:	%10
	ModifyingApplication:	%11

Fields

Message

A phase 2 crypto set was deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4

Fields

Message

A phase 2 crypto set was added to IPsec settings when Windows Defender Firewall started.

	Set ID:	%1
	Set Name:	%2
	Origin:	%4
	Pfs:	%6
	NumSuites:	%7
	ModifyingUser:	%10
	ModifyingApplication:	%11

Fields

Message

An authentication set has been added to IPsec settings.

	Set ID:	%1
	Set Name:	%2
	IPsec Phase:	%3
	Origin:	%5
	NumSuites:	%7
	ModifyingUser:	%10
	ModifyingApplication:	%11

Fields

Message

An authentication set has been modified in IPsec settings.

	Set ID:	%1
	Set Name:	%2
	IPsec Phase:	%3
	Origin:	%5
	NumSuites:	%7
	ModifyingUser:	%10
	ModifyingApplication:	%11

Fields

Message

An authentication set has been deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4

Fields

Message

An authentication set has been added to IPsec settings when Windows Defender Firewall started.

	Set ID:	%1
	Set Name:	%2
	IPsec Phase:	%3
	Origin:	%5
	NumSuites:	%7
	ModifyingUser:	%10
	ModifyingApplication:	%11

Fields

Message

Windows Defender Firewall has been reset to its default configuration.

	ModifyingUser:	%1
	ModifyingApplication:	%2

Fields

Sigma Rules

• Windows Defender Firewall Has Been Reset To Its Default Configuration
  Detects activity when Windows Defender Firewall has been reset to its default configuration

Message

All rules have been deleted from the Windows Defender Firewall configuration on this computer.

	Store Type:	%1
	ModifyingUser:	%2
	ModifyingApplication:	%3

Fields

Sigma Rules

• All Rules Have Been Deleted From The Windows Firewall Configuration
  Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Message

All connection security rules have been deleted from the IPsec configuration on this computer.

	Store Type:	%1
	ModifyingUser:	%2
	ModifyingApplication:	%3

Fields

Message

All main mode rules have been deleted from the IPsec configuration on this computer.

	Store Type:	%1
	ModifyingUser:	%2
	ModifyingApplication:	%3

Fields

Message

All authentication sets have been deleted from the IPsec configuration on this computer.

	IPsec Phase:	%1
	Store Type:	%2
	ModifyingUser:	%3
	ModifyingApplication:	%4

Fields

Message

All crypto sets have been deleted from the IPsec configuration on this computer.

	IPsec Phase:	%1
	Store Type:	%2
	ModifyingUser:	%3
	ModifyingApplication:	%4

Fields

Message

Windows Defender Firewall did not apply the following rule because the rule was not properly configured on this computer:

Rule Information:
	ID:	%1
	Name:	%2

Error Information:
	Reason:	%3

Fields

Message

Http Proxies Changed

Reason: 	%1

All Proxies:	%2

All Domain Proxies:	%3

Group Policy Configured Domain Proxies:	%4

Group Policy Configured Local Proxies:	%5

All DA Nat64 Domain Proxies:	%6

Group Policy is authoritative:	%7

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2039
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 576460752303423504
  time_created: '2023-11-05T23:50:01.858901+00:00'
  event_record_id: 1
  correlation: {}
  execution:
    process_id: 2896
    thread_id: 9248
  channel: Network Isolation Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  ChangeType: 0
  All Proxies: '*'
  All Domain Proxies: '*'
  GP Configured Domain Proxies: '*'
  GP Configured Local Proxies: '*'
  All DA Nat64 Proxies: '*'
  GP Is Authoritative: 0
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Corp Subnets Changed

Reason: 	%1

All Domain Subnets:	%2

Group Policy Configured Domain Subnets:	%3

All DA Nat64 Domain Subnets:	%4

Group Policy is authoritative:	%5

Fields

Message

Capability Changed

Reason: 	%1

Capability:	%2
Profile:	%3
IP Range Definition:	%4

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2041
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 576460752303423504
  time_created: '2023-11-05T23:50:49.936008+00:00'
  event_record_id: 6
  correlation: {}
  execution:
    process_id: 2896
    thread_id: 3800
  channel: Network Isolation Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  ChangeType: 3
  Capability: 0
  Profile: 4
  IP Range Definition: 0.0.0.0-255.255.255.255,::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Config Read Failed

Config:	%1
Error:	%2

Fields

Message

The Windows Firewall Service failed to initialize a component. Some policies may not be fully enforced. 

Component Name:	%1
Error Code:	%2

Fields

Message

Added Dynamic Keyword Address.

Error Code:	%1
Id:	%2
Keyword:	%3
Addresses	%4
AutoResolve:	%5

Fields

Message

Deleted Dynamic Keyword Address.

Error Code:	%1
Id:	%2

Fields

Message

Updated Dynamic Keyword Address.

Error Code:	%1
Id:	%2
Append:	%3
Previous Addresses:	%4
Addresses to update:	%5
Updated Addresses	%6

Fields

Message

Tenant Restrictions Policy Update.

Error code:	%1
Old Addresses:	%2
New Addresses:	%3

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2047
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:34:38.294357+00:00'
  event_record_id: 292
  correlation: {}
  execution:
    process_id: 1212
    thread_id: 3732
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-19
event_data:
  ErrorCode: 0
  PreviousAddresses: ''
  UpdatedAddresses: ''
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Added Dynamic Keyword Address.

Error Code:	%1
Id:	%2
Keyword:	%3
Addresses	%4
AutoResolve:	%5

Fields

Message

Deleted Dynamic Keyword Address.

Error Code:	%1
Id:	%2

Fields

Message

Updated Dynamic Keyword Address.

Error Code:	%1
Id:	%2
Append:	%3
Previous Addresses:	%4
Addresses to update:	%5
Updated Addresses	%6

Fields

Fields

Message

Tenant Restrictions Policy Update

Error code:	%1
Policy Change:	%2

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2051
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T06:25:51.342732+00:00'
  event_record_id: 717
  correlation: {}
  execution:
    process_id: 3344
    thread_id: 3768
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  ErrorCode: 0
  PolicyChange: 0
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Sigma Rules

• A Rule Has Been Deleted From The Windows Firewall Exception List
  Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Message

A rule has been deleted in the Windows Defender Firewall exception list.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4
	Error Code:	%5

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Firewall With Advanced Security
  guid: D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85
  event_source_name: ''
  event_id: 2052
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223374235878031360
  time_created: '2023-11-06T01:42:34.475801+00:00'
  event_record_id: 1314
  correlation: {}
  execution:
    process_id: 2896
    thread_id: 16976
  channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-19
event_data:
  RuleId: '{7F9A364D-0AAE-43ED-A6D1-8D400D83CF18}'
  RuleName: WindowsAppRuntime.1.2
  ModifyingUser: S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052
  ModifyingApplication: C:\Windows\System32\svchost.exe
  ErrorCode: 0
message: ''

Sigma Rules

• A Rule Has Been Deleted From The Windows Firewall Exception List
  Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Message

A connection security rule was deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4
	Error Code:	%5

Fields

Fields

Message

A main mode rule has been deleted in the IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4
	Error Code:	%5

Fields

Fields

Message

A phase 1 crypto set was deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4
	Error Code:	%5

Fields

Fields

Message

A phase 2 crypto set was deleted from IPsec settings.

Deleted Rule:
	Rule ID:	%1
	Rule Name:	%2
	Modifying User:	%3
	Modifying Application:	%4
	Error Code:	%5

Fields

Fields

Message

All connection security rules have been deleted from the IPsec configuration on this computer.

	Store Type:	%1
	ModifyingUser:	%2
	ModifyingApplication:	%3
	Error Code:	%4

Fields

Fields