DFIRHub

Windows event log · Microsoft-Windows-Windows Firewall With Advanced Security/Firewall2004 A rule has been added to the Windows Defender Firewall exception list

  • Defender and policy
  • 6 fields
  • Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
  • Microsoft-Windows-Windows Firewall With Advanced Security

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • PayloadData1%ServiceName%: %RuleName%
    • %ServiceName% = /Event/EventData/Data[@Name="ServiceName"]
    • %RuleName% = /Event/EventData/Data[@Name="RuleName"]
  • RemoteHost%RemoteAddresses%: %RemotePorts%
    • %RemoteAddresses% = /Event/EventData/Data[@Name="RemoteAddresses"]
    • %RemotePorts% = /Event/EventData/Data[@Name="RemotePorts"]
  • PayloadData2%ApplicationPath%
    • %ApplicationPath% = /Event/EventData/Data[@Name="ApplicationPath"]
  • PayloadData3Direction: %Direction%
    • %Direction% = /Event/EventData/Data[@Name="Direction"]
  • PayloadData4Action: %Action%
    • %Action% = /Event/EventData/Data[@Name="Action"]
  • PayloadData5Protocol: %Protocol%
    • %Protocol% = /Event/EventData/Data[@Name="Protocol"]

Value lookups

Codes that EvtxECmd turns into text

Direction

1
Inbound
2
Outbound

Action

2
Block
3
Allow

Protocol

6
TCP
17
UDP
256
All

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Windows Firewall With Advanced Security" Guid="d1bc9aff-2abf-4d71-9146-ecb2a986eb85"/>
    <EventID>2004</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000020000000000</Keywords>
    <TimeCreated SystemTime="2020-02-12 14:45:13.3651450"/>
    <EventRecordID>6327</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1900" ThreadID="10824"/>
    <Channel>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</Channel>
    <Computer>ANS-4.anshealth.com</Computer>
    <Security UserID="S-1-5-19"/>
  </System>
  <EventData>
    <Data Name="RuleId">{21B2FB86-8218-4839-ACF3-CEE5F6CC6793}</Data>
    <Data Name="RuleName">windows_ie_ac_001</Data>
    <Data Name="Origin">1</Data>
    <Data Name="ApplicationPath"></Data>
    <Data Name="ServiceName"></Data>
    <Data Name="Direction">1</Data>
    <Data Name="Protocol">256</Data>
    <Data Name="LocalPorts"></Data>
    <Data Name="RemotePorts"></Data>
    <Data Name="Action">2</Data>
    <Data Name="Profiles">2147483647</Data>
    <Data Name="LocalAddresses">*</Data>
    <Data Name="RemoteAddresses">*</Data>
    <Data Name="RemoteMachineAuthorizationList"></Data>
    <Data Name="RemoteUserAuthorizationList"></Data>
    <Data Name="EmbeddedContext">windows_ie_ac_001</Data>
    <Data Name="Flags">1</Data>
    <Data Name="Active">1</Data>
    <Data Name="EdgeTraversal">0</Data>
    <Data Name="LooseSourceMapped">0</Data>
    <Data Name="SecurityOptions">0</Data>
    <Data Name="ModifyingUser">S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052</Data>
    <Data Name="ModifyingApplication">C:\WINDOWS\System32\svchost.exe</Data>
    <Data Name="SchemaVersion">542</Data>
    <Data Name="RuleStatus">65536</Data>
    <Data Name="LocalOnlyMapped">0</Data>
  </EventData>

References

4 links

Source: evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2004.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)