BIOC Informational
✕

Windows Firewall disabled via Registry

An attacker may disable the Windows Firewall via the Registry to bypass network controls.

Module:
Platform Analytics
Agent event type:
Registry
Category:
Tampering
Status:
Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)
Indicator:

Registry action type = create_registry_key , set_registry_value AND registry value name = donotallowexceptions , enablefirewall AND registry data = 0 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* Process initiated by != svchost.exe AND dllhost.exe AND mmc.exe AND sihost.exe AND cgo name != svchost.exe AND dllhost.exe AND mmc.exe AND sihost.exe AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Symantec Corporation AND CyberArk Software Ltd. AND McAfee, Inc. AND Kaspersky Lab AND Avira Operations GmbH & Co. KG AND F-Secure Corporation AND IBM Corporation AND cgo signer != Symantec Corporation AND CyberArk Software Ltd. AND McAfee, Inc. AND Kaspersky Lab AND Avira Operations GmbH & Co. KG AND F-Secure Corporation AND IBM Corporation Host host os = windows

Preventable: yes