detection.wiki

Microsoft-Windows-Windows Firewall With Advanced Security › Event 2004

Event ID 2004 — A rule has been added to the Windows Defender Firewall exception list.

Provider
Microsoft-Windows-Windows Firewall With Advanced Security
Channel
Firewall
Level
Informational
Collection Priority
Recommended (NSA)
Opcode
Info

Description

A rule has been added to the Windows Defender Firewall exception list.

Message #

A rule has been added to the Windows Defender Firewall exception list.

Added Rule:
	Rule ID: %1
	Rule Name: %2
	Origin: %3
	Active: %18
	Direction: %6
	Profiles: %11
	Action: %10
	Application Path: %4
	Service Name: %5
	Protocol: %7
	Security Options: %21
	Edge Traversal: %19
	Modifying User: %22
	Modifying Application: %23

Fields #

NameDescription
RuleId UnicodeStringGUID uniquely identifying the new firewall rule
RuleName UnicodeStringName of the firewall rule as it appears in Windows Firewall
Origin UInt32—
ApplicationPath UnicodeStringPath to the application this rule applies to, if application-specific
ServiceName UnicodeStringName of the service this rule applies to, if service-specific
Direction UInt32Direction of the rule: 1 for inbound, 2 for outbound
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Protocol UInt16—
Known values
0
HOPOPT
1
ICMP
2
IGMP
6
TCP
17
UDP
41
IPv6
43
IPv6-Route
44
IPv6-Frag
47
GRE
50
ESP
51
AH
58
ICMPv6
89
OSPF
103
PIM
132
SCTP
LocalPorts UnicodeString—
RemotePorts UnicodeString—
Action UInt32Firewall action: 3 for allow, 2 for block
Profiles UInt32Firewall profiles (Private/Domain/Public) this rule applies to
Bitmask flags
0x00000001
Domain
0x00000002
Private
0x00000004
Public
LocalAddresses UnicodeString—
RemoteAddresses UnicodeString—
RemoteMachineAuthorizationList UnicodeString—
RemoteUserAuthorizationList UnicodeString—
EmbeddedContext UnicodeString—
Flags UInt16—
Active UInt16Whether the rule is enabled: 0 for disabled, 1 for enabled
EdgeTraversal UInt16—
LooseSourceMapped UInt16—
SecurityOptions UInt16Security options: 0 for none, 1 for require authentication
ModifyingUser SIDSID of the account that added the firewall rule
ModifyingApplication UnicodeStringFull image path of the process that added the firewall rule
SchemaVersion UInt16—
RuleStatus UInt32—
LocalOnlyMapped UInt16—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Windows Firewall With Advanced Security",
    "guid": "D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85",
    "event_source_name": "",
    "event_id": 2004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223374235878031360,
    "time_created": "2022-04-07T17:06:55.849451+00:00",
    "event_record_id": 173,
    "correlation": {},
    "execution": {
      "process_id": 1928,
      "thread_id": 5436
    },
    "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "RuleId": "ADDS-NB-Datagram-UDP-In",
    "RuleName": "Active Directory Domain Controller - NetBIOS name resolution (UDP-In)",
    "Origin": 1,
    "ApplicationPath": "System",
    "ServiceName": "",
    "Direction": 1,
    "Protocol": 17,
    "LocalPorts": "138",
    "RemotePorts": "*",
    "Action": 3,
    "Profiles": 2147483647,
    "LocalAddresses": "*",
    "RemoteAddresses": "*",
    "RemoteMachineAuthorizationList": "",
    "RemoteUserAuthorizationList": "",
    "EmbeddedContext": "@FirewallAPI.dll,-37601",
    "Flags": 1,
    "Active": 1,
    "EdgeTraversal": 0,
    "LooseSourceMapped": 0,
    "SecurityOptions": 0,
    "ModifyingUser": "S-1-5-18",
    "ModifyingApplication": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\\TiWorker.exe",
    "SchemaVersion": 543,
    "RuleStatus": 65536,
    "LocalOnlyMapped": 0
  },
  "message": ""
}

References #