A firewall rule was deleted.
Deleting existing security-focused firewall rules to open network paths for attack or exfiltration.
Alert: deletion of restrictive rules (especially outbound block rules). Alert: outside change management windows.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Defense Evasion | Disable or Modify System Firewall (T1562.004) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4948 // A change has been made to Windows Firewall exception list — a rule was deleted
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4948
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A change has been made to Windows Firewall exception list — a rule was deleted — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A change has been made to Windows Firewall exception list — a rule was deleted. A firewall rule was deleted.
Event 4948 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Event 4948 is associated with: Disable or Modify System Firewall (T1562.004).
Alert: deletion of restrictive rules (especially outbound block rules). Alert: outside change management windows.