Splunk unknown stable spl

Windows Firewall Rule Modification

This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.

View Source

Detection Logic

`wineventlog_security` EventCode=4947
| stats count min(_time) as firstTime max(_time) as lastTime
    BY RuleName signature subject
       status dest ProcessID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_firewall_rule_modification_filter`

False Positives

  • ⚠ Legitimate admin changes, Group Policy updates, software installs, security tools, and automated scripts can trigger false positives for Event ID 4947.

Field Validations

Loading…

Comments (0)

Loading comments...