Windows Firewall Rules
Whether the firewall is on per profile, and the stored rule set.
Use it to tell whether the firewall was switched off or a new allow rule opened a path in.
- SYSTEM
- Defence Evasion
What It Is
Windows Firewall is the firewall built into Windows, and it is on by default in every edition. By default it blocks incoming traffic unless the machine asked for it or a rule allows it, and lets outgoing traffic out unless a rule blocks it. It has three network profiles, domain, private and public, and applies the one that fits the network the machine is on, so rules can differ between them. This key, in the SYSTEM hive, is where the Windows Firewall service (MpsSvc) keeps its configuration.
What It Proves
EnableFirewall set to 0 on a profile turns the firewall off for it. A new value under FirewallRules adds a rule. An inbound allow for a high port or a binary in a user-writable path opens a way in.
What It Does Not Prove
The rule strings are packed into one value each and need parsing. Group Policy also writes rules under a Policies path, so an empty local key does not mean no rules apply.
Where It Lives
Windows Firewall Rules lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The firewall is off for the private profile. Date the change from the profile key last write time, then check what connected while it was down. |
| An inbound allow for a high port tied to a binary in a user Temp folder. Remove the rule, hash s |
| The firewall is on for the domain profile, the secure state. Compare the three profiles, since they are set independently. |
How to Read It
Read EnableFirewall under FirewallPolicy\<profile>Profile (Domain, Standard, Public). Read the FirewallRules values and parse each into action, direction, port and application. To put it right, turn the profile back on, remove the unexpected rule, and check for recent inbound connections.
- When Windows Writes It
- When an administrator, netsh, Group Policy, or an attacker with admin rights changes a profile or rule.
- Which Windows Versions
- Windows XP SP2 to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
Defender is not known to record the FirewallPolicy profile and rule values, so this reads the Group Policy copy, which it does record. A quiet result does not clear the host, so read the rules with Velociraptor.
// Firewall settings written to the Group Policy copyDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Windows Firewall Rules shows.
- Firewall Rule Added, Security Event 4946Not in the RegistryRecords each rule added, with its name and time, if rule-level auditing is on.
- Firewall Setting Changed, Security Event 4950Not in the RegistryRecords a setting change, such as a profile turned off, and when.
Sources
The facts on this page come from these public pages, which say more on each point.
- Velociraptor: Windows.Sys.FirewallRules (opens in a new tab)
- MITRE ATT&CK T1686: Disable or Modify System Firewall (opens in a new tab)
- Microsoft Learn: Windows Firewall overview (opens in a new tab)
- Microsoft Learn: Windows Update error 0x800706D9 (the Windows Firewall registry configuration) (opens in a new tab)