An existing firewall rule was modified.
Modifying existing firewall rules to broaden permissions or redirect allowed traffic.
Alert: modification of rules restricting outbound C2 channels. Alert: changes outside change management windows.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Defense Evasion | Disable or Modify System Firewall (T1562.004) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4947 // A change has been made to Windows Firewall exception list — a rule was modified
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4947
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A change has been made to Windows Firewall exception list — a rule was modified — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A change has been made to Windows Firewall exception list — a rule was modified. An existing firewall rule was modified.
Event 4947 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Event 4947 is associated with: Disable or Modify System Firewall (T1562.004).
Alert: modification of rules restricting outbound C2 channels. Alert: changes outside change management windows.