Detection rules › Sigma
Windows Defender Firewall Has Been Reset To Its Default Configuration
Detects activity when Windows Defender Firewall has been reset to its default configuration
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1562.004 Impair Defenses: Disable or Modify System Firewall |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Windows-Firewall-With-Advanced-Security | 2032 | |
| Windows-Firewall-With-Advanced-Security | 2060 |