Detection: Windows Firewall Rule Modification

Updated Date: 2025-03-19 ID: fe7efbf7-5f82-44b9-8c33-316189ab2393 Author: Teoderick Contreras, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.

Search

1`wineventlog_security` EventCode=4947 
2| stats count min(_time) as firstTime max(_time) as lastTime by RuleName signature subject status dest ProcessID 
3| `security_content_ctime(firstTime)` 
4| `security_content_ctime(lastTime)` 
5| `windows_firewall_rule_modification_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4947	Windows	`'xmlwineventlog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_firewall_rule_modification_filter	`search *`

windows_firewall_rule_modification_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1562.004	Disable or Modify System Firewall	Defense Evasion

Exploitation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This detection is based on data collected from Endpoint Detection and Response (EDR) agents, which provide security-related telemetry from monitored endpoints. Specifically, it focuses on Windows Security Event Log entries with EventID 4947, which indicates that a Windows Firewall rule has been modified. To implement this detection in Splunk, you must ingest Windows Security Event Logs that capture EventID 4947, ensuring that critical fields such as _time, EventRecordID, ProcessID, ThreadID, Computer, ProfileChanged, RuleName, and RuleId are available for analysis. These logs must be processed using the appropriate Splunk Technology Add-ons (TAs) to ensure compatibility with the EDR product and proper field extraction. Additionally, mapping these logs to the appropriate data model, such as the Endpoint data model, enhances structured analysis. Leveraging the Splunk Common Information Model (CIM) helps normalize field names, ensuring consistency across different data sources. By implementing this approach, you can effectively detect and monitor Windows Firewall rule modifications, providing visibility into potential security risks or unauthorized changes.

Known False Positives

Legitimate admin changes, Group Policy updates, software installs, security tools, and automated scripts can trigger false positives for Event ID 4947.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

a firewall rule $RuleName$ has been modified on $dest$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest	system	20	No Threat Objects

References

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4947

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1