EventID 2005: Firewall Rule Modified
Last updated
Last updated
This event indicates that a firewall rule has been modified. The contents of this event will contain the new parameters of the firewall rule.
In recent builds of Windows 11, this event has been replaced by a new Event ID:
| Major Version | Support | Major Version | Support |
|---|---|---|---|
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
The presence of this event indicates that the system's firewall was modified by editing a rule. This may be indicative of attacker activity. There are many legitimate processes such as svchost.exe that will be observed modifying the Windows Firewall, so this event should be correlated with others to determine if the activity is legitimate or not.
The following additional fields are available in this event:
On an example system, an existing Windows Firewall rule was modified from within the Windows Defender Firewall with Advanced Security control panel, causing the following event to be logged:
This example was produced on Windows 10, Version 10.0.19044 Build 19044
On an example system, an existing Windows Firewall rule was modified from within the Windows Defender Firewall with Advanced Security control panel, causing the following event to be logged:
This example was produced on Windows 11, Version 10.0.22621 Build 22621
| Field | Interpretation | Reference |
|---|---|---|
| XML Path | Interpretation |
|---|---|
System/Security/UserID
Provides the Security Identifier (SID) of the account that modified the firewall rule.
EventData/ModifyingUser
Provides the Security Identifier (SID) of the account that modified the firewall rule.
EventData/ModifyingApplication
Provides the full image path of the process that modified the firewall rule.
System/Execution/ProcessID
Provides the Process ID of the application that modified the firewall rule.
System/Execution/ThreadID
Provides the Thread ID of the application that modified the firewall rule.
EventData/RuleId
A GUID for the firewall rule
EventData/RuleName
The name for the firewall rule as it appears in the Windows Firewall
EventData/Direction
1 for inbound rules and 2 for outbound rules
EventData/Profiles
What profiles (Private/Domain/Public) this rule applies to.
EventData/Active
0 for disabled rules and 1 for enabled rules
EventData/Action
3 for allow and 2 for block
EventData/SecurityOptions
0 for none and 1 for require authentication
EventData/ApplicationPath
If the rule applies only to a specific application it will be listed here
EventData/ServiceName
If the rule applies only to a specific service it will be listed here
Windows 11
⚠️
Server 2019
✅
Windows 10
✅
Server 2016
✅
Windows 8
✅
Server 2012
✅
Windows 7
✅
Server 2008
✅
Windows Vista
✅
Server 2003
❌
Windows XP
❌