Allow Exceptions in Microsoft Defender Firewall via Registry

Title: Allow Exceptions in Microsoft Defender Firewall via Registry
Status: experimental
Description:Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft Defender Firewall and can restore network paths that a hardened profile would block.
References:
  -https://www.virustotal.com/gui/file/da209017000b9812e8bc5f4e8db6499430ee2aadc72ef896964cffdfd896f143/behavior
  -https://app.any.run/tasks/8d4113a8-5403-4367-a79f-4ce4978d9bdb
  -https://www.zscaler.com/fr/blogs/security-research/malvertising-targeting-european-transit-users
  -https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zbot.e
Author: frack113
Date: 2026-10-13
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1686.003'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Services\SharedAccess\Parameters\FirewallPolicy\'
    TargetObject|endswith: '\DoNotAllowExceptions'
    Details: 'DWORD (0x00000000)'
  filter_main_svchost:
    Image:
      -'C:\Windows\System32\svchost.exe'
      -'C:\Windows\SysWOW64\svchost.exe'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium