Rule Info
Name
Allow Exceptions in Microsoft Defender Firewall via Registry
Author
frack113
Description
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
Date
2026-10-13 00:00:00
Modified
None
Id
c69fc6a2-607d-4530-b7d1-75823af1bde4
Tags
attack.defense-impairment attack.t1686.003
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
frack113
Merge PR #5172 from @frack113 - Microsoft Defender Firewall Weakening via Registry
2026-10-13
Scan your endpoints, forensic images or collected files with our portable scanner THOR