Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Known false positives

Legitimate use

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
id: 48917adc-a28e-4f5d-b729-11e75da8941f
status: test
description: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.
references:
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
    - https://redcanary.com/threat-detection-report/threats/qbot/
author: frack113
date: 2022-02-13
modified: 2023-02-04
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\reg.exe'
        CommandLine|contains:
            - 'SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'
            - 'SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths'
        CommandLine|contains|all:
            - 'ADD '
            - '/t '
            - 'REG_DWORD '
            - '/v '
            - '/d '
            - '0'
    condition: selection
falsepositives:
    - Legitimate use
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
        - 'SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'
        - 'SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths'
    CommandLine|contains|all:
        - 'ADD '
        - '/t '
        - 'REG_DWORD '
        - '/v '
        - '/d '
        - '0'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/d` corpus 2 (sigma 2) `/t` corpus 2 (sigma 2) `/v` corpus 2 (sigma 2) `0` corpus 6 (sigma 6) `ADD` corpus 12 (sigma 12) `REG_DWORD` `SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths` `SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`