DFIRHub

Windows event log · Microsoft-Windows-Windows Firewall With Advanced Security/Firewall2005 A rule has been modified in the Windows Defender Firewall exception list

  • Defender and policy
  • 6 fields
  • Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
  • Microsoft-Windows-Windows Firewall With Advanced Security

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • PayloadData1%ServiceName%: %RuleName%
    • %ServiceName% = /Event/EventData/Data[@Name="ServiceName"]
    • %RuleName% = /Event/EventData/Data[@Name="RuleName"]
  • RemoteHost%RemoteAddresses%: %RemotePorts%
    • %RemoteAddresses% = /Event/EventData/Data[@Name="RemoteAddresses"]
    • %RemotePorts% = /Event/EventData/Data[@Name="RemotePorts"]
  • PayloadData2%ApplicationPath%
    • %ApplicationPath% = /Event/EventData/Data[@Name="ApplicationPath"]
  • PayloadData3Direction: %Direction%
    • %Direction% = /Event/EventData/Data[@Name="Direction"]
  • PayloadData4Action: %Action%
    • %Action% = /Event/EventData/Data[@Name="Action"]
  • PayloadData5Protocol: %Protocol%
    • %Protocol% = /Event/EventData/Data[@Name="Protocol"]

Value lookups

Codes that EvtxECmd turns into text

Direction

1
Inbound
2
Outbound

Action

2
Block
3
Allow

Protocol

6
TCP
17
UDP
256
All

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Windows Firewall With Advanced Security" Guid="{GUID}"/>
    <EventID>2005</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000020000000000</Keywords>
    <TimeCreated SystemTime="2020-12-12T07:32:38.9121196Z"/>
    <EventRecordID>3509</EventRecordID>
    <Correlation/>
    <Execution ProcessID="2964" ThreadID="22020"/>
    <Channel>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="{UserID}"/>
  </System>
  <EventData>
    <Data Name="RuleId">UDP Query User{~~~~}C:\users\hyuunnn\downloads\anydesk.exe</Data>
    <Data Name="RuleName">anydesk.exe</Data>
    <Data Name="Origin">1</Data>
    <Data Name="ApplicationPath">C:\users\hyuunnn\downloads\anydesk.exe</Data>
    <Data Name="ServiceName"/>
    <Data Name="Direction">1</Data>
    <Data Name="Protocol">17</Data>
    <Data Name="LocalPorts">*</Data>
    <Data Name="RemotePorts">*</Data>
    <Data Name="Action">3</Data>
    <Data Name="Profiles">2</Data>
    <Data Name="LocalAddresses">*</Data>
    <Data Name="RemoteAddresses">*</Data>
    <Data Name="RemoteMachineAuthorizationList"/>
    <Data Name="RemoteUserAuthorizationList"/>
    <Data Name="EmbeddedContext"/>
    <Data Name="Flags">257</Data>
    <Data Name="Active">1</Data>
    <Data Name="EdgeTraversal">3</Data>
    <Data Name="LooseSourceMapped">0</Data>
    <Data Name="SecurityOptions">0</Data>
    <Data Name="ModifyingUser">S-1-5-21-2856883770-2223847312-2813546713-1001</Data>
    <Data Name="ModifyingApplication">C:\Windows\System32\dllhost.exe</Data>
    <Data Name="SchemaVersion">522</Data>
    <Data Name="RuleStatus">65536</Data>
    <Data Name="LocalOnlyMapped">0</Data>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2005.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)