Detectionmediumtest

Windows Defender Exclusion List Modified

Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
@barryshooshoogaCreated Sat Oct 26Updated Sat Nov 1146a68649-f218-4f86-aea1-16a759d81820windows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security

Definition

Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User

Detection Logic
Detection Logic1 selector
detection:
    selection:
        EventID: 4657 # A registry value was modified.
        ObjectName|contains: '\Microsoft\Windows Defender\Exclusions\'
    condition: selection
False Positives

Intended exclusions by administrators

Rule Metadata
Rule ID
46a68649-f218-4f86-aea1-16a759d81820
Status
test
Level
medium
Type
Detection
Created
Sat Oct 26
Modified
Sat Nov 11
Path
rules/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml
Raw Tags
attack.defense-evasionattack.t1562.001
View on GitHub