Windows Firewall service stopped.
Attackers disable Windows Firewall to remove network restrictions enabling C2 callbacks or lateral movement. Also done before deploying network-based tools.
Alert on every occurrence outside documented maintenance.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Defense Evasion | Disable or Modify System Firewall (T1562.004) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Windows Firewall Service Stopped
status: stable
description: Windows Firewall stopped — possible defense evasion
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 5025
condition: selection
falsepositives:
- Planned maintenance
level: high
tags:
- attack.defense_evasion
- attack.t1562.004
SecurityEvent
| where EventID == 5025 // The Windows Firewall Service has been stopped
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=5025
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The Windows Firewall Service has been stopped — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
The Windows Firewall Service has been stopped. Windows Firewall service stopped.
Event 5025 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Event 5025 is associated with: Disable or Modify System Firewall (T1562.004).
Alert on every occurrence outside documented maintenance.