Detection rules › Splunk
Windows Firewall Rule Deletion
This detection identifies instances where a Windows Firewall rule has been deleted, potentially exposing the system to security risks. Unauthorized removal of firewall rules can indicate an attacker attempting to bypass security controls or malware disabling protections for persistence and command-and-control communication. The event logs details such as the deleted rule name, protocol, port, and the user responsible for the action. Security teams should monitor for unexpected deletions, correlate with related events, and investigate anomalies to prevent unauthorized access and maintain network security posture.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1562.004 Impair Defenses: Disable or Modify System Firewall |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4948 | A change has been made to Windows Firewall exception list. A rule was deleted. |
Stages and Predicates
Stage 1: search
search EventCode=4948
Stage 2: stats
stats BY RuleName, signature, subject, status, dest, ProcessID
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|