4950 Security log · Windows Firewall high severity low volume

Windows Event ID 4950 — A Windows Firewall setting has changed

A global Windows Firewall setting was changed (not a specific rule).

Why event 4950 matters

Global firewall disable or profile switching to expose the host. Attackers may switch from Domain profile (stricter) to Public profile (more permissive) or simply disable the firewall.

How to detect it

Alert: firewall state changed to OFF for any profile. Alert: profile changed to less restrictive settings.

Log source
Security
Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Disable or Modify System Firewall (T1562.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4950   // A Windows Firewall setting has changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4950
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A Windows Firewall setting has changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4950 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Windows Firewall events

4944 The following policy was active when the Windows Firewall started 4946 A change has been made to Windows Firewall exception list — a rule was added 4947 A change has been made to Windows Firewall exception list — a rule was modified 4948 A change has been made to Windows Firewall exception list — a rule was deleted 4957 Windows Firewall did not apply the following rule 5024 The Windows Firewall Service has started successfully 5025 The Windows Firewall Service has been stopped 5031 Windows Firewall blocked an application from accepting incoming connections

Frequently asked questions

What is Windows Event ID 4950?

A Windows Firewall setting has changed. A global Windows Firewall setting was changed (not a specific rule).

Which log records event 4950?

Event 4950 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4950?

Event 4950 is associated with: Disable or Modify System Firewall (T1562.004).

How do you detect activity around event 4950?

Alert: firewall state changed to OFF for any profile. Alert: profile changed to less restrictive settings.