Detections
- ID: DT082
- Created: 24th July 2024
- Updated: 24th July 2024
- Platform: Windows
- Contributor: The ITM Team
Windows Event Log, Local Firewall Changes
Event ID 4946: A change has been made to Windows Firewall exception list. A rule was added.
This event indicates that a change has been made to the Windows Firewall settings and typically logs information about the specific settings that were changed.
Event ID 4947: A change has been made to Windows Firewall exception list. A rule was modified.
This event is logged when an outbound rule is modified in the Windows Firewall. It provides details about the rule that was changed.
Event ID 4948: A change has been made to Windows Firewall exception list. A rule was deleted.
This event is logged when an inbound rule is modified in the Windows Firewall. It provides details about the rule that was changed.
Event ID 4950: A Windows Firewall setting has changed.
This event indicates that a change has been made to the Windows Firewall's global configuration, such as enabling or disabling the firewall.
Sections
| ID | Name | Description |
|---|---|---|
| PR018 | Circumventing Security Controls | A subject abuses their access or conducts unapproved changes to circumvent host-based security controls. |
| PR018.004 | Modifying a Host-Based Firewall | A subject abuses their access or conducts unapproved changes by modifying the local host firewall, such as editing inbound or outbound rules, or disabling it. |
| AF029.002 | Unauthorized VPN Usage | The subject deliberately uses Virtual Private Network (VPN) technology in a manner that circumvents organizational oversight, masking the nature, destination, or content of network activity. This includes installing unapproved VPN clients, as well as reconfiguring sanctioned VPN software to route traffic through unauthorized exit nodes, personal infrastructure, or third-party services not governed by corporate policy.
By diverting traffic away from monitored pathways, the subject obstructs standard telemetry collection - evading logging of session destinations, data transfers, or identity-bound usage. This behavior frustrates forensic reconstruction, hinders real-time monitoring, and degrades the reliability of investigative artifacts. Unauthorized VPN usage is an intentional anti-forensics measure aimed at concealing potentially harmful activity behind layers of encrypted and unsanctioned transit. |