Windows Defender Exclusion List Modified
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Definition
Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User
detection:
selection:
EventID: 4657 # A registry value was modified.
ObjectName|contains: '\Microsoft\Windows Defender\Exclusions\'
condition: selectionIntended exclusions by administrators
Tactics
Sub-techniques
Windows Defender Exclusion Registry Key - Write Access Requested
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
This rule was derived from the related rule - both detect similar activity with different scope.
a33f8808-2812-4373-ae95-8cfb82134978