5025 Security log · Windows Firewall high severity low volume

Windows Event ID 5025 — The Windows Firewall Service has been stopped

Windows Firewall service stopped.

Why event 5025 matters

Attackers disable Windows Firewall to remove network restrictions enabling C2 callbacks or lateral movement. Also done before deploying network-based tools.

How to detect it

Alert on every occurrence outside documented maintenance.

Log source
Security
Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Disable or Modify System Firewall (T1562.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Windows Firewall Service Stopped
status: stable
description: Windows Firewall stopped — possible defense evasion
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5025
    condition: selection
falsepositives:
    - Planned maintenance
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.004
Sentinel / Defender KQL
SecurityEvent
| where EventID == 5025   // The Windows Firewall Service has been stopped
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=5025
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The Windows Firewall Service has been stopped — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 5025 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Windows Firewall events

4944 The following policy was active when the Windows Firewall started 4946 A change has been made to Windows Firewall exception list — a rule was added 4947 A change has been made to Windows Firewall exception list — a rule was modified 4948 A change has been made to Windows Firewall exception list — a rule was deleted 4950 A Windows Firewall setting has changed 4957 Windows Firewall did not apply the following rule 5024 The Windows Firewall Service has started successfully 5031 Windows Firewall blocked an application from accepting incoming connections

Frequently asked questions

What is Windows Event ID 5025?

The Windows Firewall Service has been stopped. Windows Firewall service stopped.

Which log records event 5025?

Event 5025 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5025?

Event 5025 is associated with: Disable or Modify System Firewall (T1562.004).

How do you detect activity around event 5025?

Alert on every occurrence outside documented maintenance.