Windows Event ID 4946 — A change has been made to Windows Firewall exception list — a rule was added — SecOps Tools

Why event 4946 matters

Attackers add firewall rules to allow C2 traffic, open additional access ports, or allow malicious services to communicate outbound. Tools: netsh advfirewall firewall add rule.

How to detect it

Alert: rules added allowing inbound access on non-standard ports. Alert: rules added for processes in temp/user directories. Alert: any firewall rule addition outside change management.

Log source

Security

Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	Disable or Modify System Firewall (T1562.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: Windows Firewall Rule Added
status: stable
description: Firewall exception rule added
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4946
    condition: selection
falsepositives:
    - Legitimate software installation
    - IT-approved rule changes
level: medium
tags:
    - attack.defense_evasion
    - attack.t1562.004

Sentinel / Defender KQL

SecurityEvent
| where EventID == 4946   // A change has been made to Windows Firewall exception list — a rule was added
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=4946
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A change has been made to Windows Firewall exception list — a rule was added — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4946 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Windows Firewall events

4944 The following policy was active when the Windows Firewall started 4947 A change has been made to Windows Firewall exception list — a rule was modified 4948 A change has been made to Windows Firewall exception list — a rule was deleted 4950 A Windows Firewall setting has changed 4957 Windows Firewall did not apply the following rule 5024 The Windows Firewall Service has started successfully 5025 The Windows Firewall Service has been stopped 5031 Windows Firewall blocked an application from accepting incoming connections

Frequently asked questions

What is Windows Event ID 4946?

A change has been made to Windows Firewall exception list — a rule was added. A new Windows Firewall rule was added. RuleName and ApplicationPath are key.

Which log records event 4946?

Event 4946 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4946?

Event 4946 is associated with: Disable or Modify System Firewall (T1562.004).

How do you detect activity around event 4946?

Alert: rules added allowing inbound access on non-standard ports. Alert: rules added for processes in temp/user directories. Alert: any firewall rule addition outside change management.