Windows Defender Exclusions by Path

[rule]
description = """
Identifies modifications to the Windows Defender configuration settings to exclude a recently dropped or modified
executable.
"""
id = "e6cebe64-0f47-42e9-813e-fd9a53aa59b1"
license = "Elastic License v2"
name = "Windows Defender Exclusions by Path"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps",
]
version = "1.0.14"

query = '''
sequence with maxspan=1m
[process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
 not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true) and
 not (process.code_signature.subject_name == "Datto Inc" and process.code_signature.trusted == true)
 ] by process.name
[registry where
 registry.path :
       ("HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\*",
        "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\*")] by registry.value
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"