huntrule

Suspicious Windows Defender Exclusions Added - Registry (via registry_set)

This rule detects the Setting of Windows Defender Exclusions

SigmamediumWindowsv1
sigma
title: Suspicious Windows Defender Exclusions Added - Registry (via registry_set)
id: 6e67a1c4-df70-5c58-be9c-93ff3cca19b3
status: stable
description: This rule detects the Setting of Windows Defender Exclusions
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://twitter.com/_nullbind/status/1204923340810543109
author: Huntrule Team
date: 2026-06-15
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_set
detection:
    selection2:
        TargetObject|contains: '\Microsoft\Windows Defender\Exclusions'
    condition: selection2
falsepositives:
    - Unknown
level: medium

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.