Detects creation or re-enabling of per-application firewall exceptions by registry writes to the AuthorizedApplications\List keys under FirewallPolicy in Windows Defender Firewall settings. The rule triggers on registry_set events where the TargetObject path contains the FirewallPolicy or AuthorizedApplications\List and Details contain :Enabled:. Such changes grant network access to the specified executable, potentially allowing malware or attackers to bypass network restrictions, C2 communication, or data exfiltration. This is a defense-evasion technique (T1686.003) with a medium impact, and can result from both adversarial activity and legitimate IT administration tasks, so correlate with other telemetry to reduce false positives.