Detection rules › Sigma
Windows Defender Exclusions Added
Detects the Setting of Windows Defender Exclusions
Known false positives
- Administrator actions
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Windows-Defender | Event ID 5007: Product Name Configuration has changed. |
Rule body
title: Windows Defender Exclusions Added
id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f
status: stable
description: Detects the Setting of Windows Defender Exclusions
references:
- https://twitter.com/_nullbind/status/1204923340810543109
author: Christian Burkard (Nextron Systems)
date: 2021-07-06
modified: 2022-12-06
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 5007 # The antimalware platform configuration changed.
NewValue|contains: '\Microsoft\Windows Defender\Exclusions'
condition: selection
falsepositives:
- Administrator actions
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 5007
NewValue|contains: '\Microsoft\Windows Defender\Exclusions'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
NewValue | match |
| field:"Details" kind:match value:"\Microsoft\Windows Defender\Exclusions" |