win:firewall
Windows Firewall log
Channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 4
- Rules listed
- 9
- Events
- 17
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destination | Supports an activity | our analysis |
Techniques
Rules
Sigma 9
- A Rule Has Been Deleted From The Windows Firewall Exception List by frack113
- All Rules Have Been Deleted From The Windows Firewall Configuration by frack113, Nasreddine Bencherchali (Nextron Systems)
- Firewall Rule Modified In The Windows Firewall Exception List by frack113
- New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application by frack113
- New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
- The Windows Defender Firewall Service Failed To Load Group Policy by frack113
- Uncommon New Firewall Rule Added In Windows Firewall Exception List by frack113
- Windows Defender Firewall Has Been Reset To Its Default Configuration by frack113
- Windows Firewall Settings Have Been Changed by frack113, Nasreddine Bencherchali (Nextron Systems)