BIOC
Informational
✕
Windows Firewall notifications disabled via Registry
These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Tampering
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Impair Defenses: Disable or Modify System Firewall (T1562.004)
Indicator:
Registry registry data = 1 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* AND registry value name = disablenotifications AND action type = set_registry_value Process initiator path != *leverit* AND *kaspersky* AND *f-secure* AND cgo path != *leverit* AND *kaspersky* AND *f-secure* AND initiated by != svchost.exe AND dllhost.exe AND cgo name != svchost.exe AND dllhost.exe Host host os = windows
Preventable: yes