Add Authorized Applications to Microsoft Defender Firewall via Registry — Detection Rule
Detects the degradation of the system firewall security by the creation or re-enabling of per-application exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants the targeted executable network access and can be abused by malware to bypass network restrictions.