Add Authorized Applications to Microsoft Defender Firewall via Registry

frack113

Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.

2026-10-13 00:00:00

None

6648f900-4a7d-47e3-bad6-952b313a1c0e

attack.defense-impairment attack.t1686.003

Community Rule

frack113

Merge PR #5172 from @frack113 - Microsoft Defender Firewall Weakening via Registry

2026-10-13