Detection rules › Sigma
Windows Defender Exploit Guard Tamper
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | T1685 Disable or Modify Tools |
Event coverage
| Provider | Event |
|---|---|
| Windows-Defender | Event ID 5007 |
Rule body yaml
title: Windows Defender Exploit Guard Tamper
id: a3ab73f1-bd46-4319-8f06-4b20d0617886
status: test
description: |
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
references:
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-05
modified: 2022-12-06
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
service: windefend
detection:
allowed_apps_key:
EventID: 5007 # The antimalware platform configuration changed.
NewValue|contains: '\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\'
allowed_apps_path:
NewValue|contains:
# Add more paths you don't allow in your org
- '\Users\Public\'
- '\AppData\Local\Temp\'
- '\Desktop\'
- '\PerfLogs\'
- '\Windows\Temp\'
protected_folders:
EventID: 5007 # The antimalware platform configuration changed.
# This will trigger on any folder removal. If you experience FP's then add another selection with specific paths
OldValue|contains: '\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\'
condition: all of allowed_apps* or protected_folders
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
all of allowed_apps* or protected_foldersStage 1: allowed_apps_key
allowed_apps_key:
EventID: 5007
NewValue|contains: '\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\'
Stage 2: allowed_apps_path
allowed_apps_path:
NewValue|contains:
- '\Users\Public\'
- '\AppData\Local\Temp\'
- '\Desktop\'
- '\PerfLogs\'
- '\Windows\Temp\'
Stage 3: protected_folders
protected_folders:
EventID: 5007
OldValue|contains: '\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.