BIOC Informational

Windows Firewall notifications disabled via Registry

These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings.

Module:
Platform Analytics
Agent event type:
Registry
Category:
Tampering
Status:
Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Impair Defenses: Disable or Modify System Firewall (T1562.004)
Indicator:

Registry registry data = 1 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* AND registry value name = disablenotifications AND action type = set_registry_value Process initiator path != *leverit* AND *kaspersky* AND *f-secure* AND cgo path != *leverit* AND *kaspersky* AND *f-secure* AND initiated by != svchost.exe AND dllhost.exe AND cgo name != svchost.exe AND dllhost.exe Host host os = windows

Preventable: yes