Local Firewall Policy Merge Allowed Via AllowLocalPolicyMerge Registry Value

Rule Info

Name
Local Firewall Policy Merge Allowed Via AllowLocalPolicyMerge Registry Value
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the deletion or setting of the "AllowLocalPolicyMerge" registry value with a data of "DWORD (0x00000001)". This would allow the merging of local firewall rules with those of the group policy. This may weaken intended group policy firewall configurations.
Reference
https://www.stigviewer.com/stig/windows_7/2013-03-14/finding/V-17422
Date
2024-07-09 00:00:00
Modified
None
Id
59c10206-89b7-4993-a842-360de3469859
Tags
attack.defense-evasion
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022