Lion Cipher Lab

Detect Windows Firewall tampering from the firewall's own change events

• SOC Analyst / Blue Team
• Intermediate
• ~75 min
• Free · no account required

Why it matters

An intruder who wants to reach a machine over Remote Desktop, move laterally over SMB, or let their own tool listen for a connection often has to get past the Windows host firewall first. The quickest ways are blunt: switch the firewall off, add an inbound allow rule, re-enable a rule group that was off, or delete the block rule that stood in the way. MITRE ATT&CK tracks this as T1686.003, Windows Host Firewall. Windows records every one of those changes, but it also records thousands of harmless ones: Windows re-registering app rules, browser updaters adding their own rules, per-user apps…

What you'll learn

• Knowing the two places Windows records firewall changes: the Security log (4946-4950, needs the MPSSVC Rule-Level Policy Change audit subcategory) and the Windows Firewall With Advanced Security/Firewall channel (2097/2099/2052/2082 on Windows 11)
• Decoding firewall event fields with Microsoft's [MS-FASP] enums: Direction, Action, Origin and the profile setting type
• Using ModifyingApplication to tell the firewall service, installers, netsh and WMI (PowerShell NetSecurity cmdlets) apart
• Writing a T1686.003 (Windows Host Firewall, formerly T1562.004) detection that covers profile disables, inbound allow rules, re-enabled rule groups and deleted block rules
• Measuring precision and recall of five rules against labeled data and reading every false positive
• Recognising when a noise filter (a change ticket, a self-registering app) also hides an attack, and layering rules so it cannot

Steps in this lab

1. What tampering with the host firewall looks like, and why it matters
2. Two logs record firewall changes - and they are not the same
3. Learn the event IDs and decode the numbers
4. Why the obvious rules fail (the judgement)
5. Build the synthetic week of firewall events
6. Write five rules and score them
7. Read the results like an analyst, not a scoreboard
8. Optional: look at your own firewall's change log (read-only)
9. Name the limits - what this log cannot tell you
10. When to use this, and what a pro does differently

Open the full interactive lab →