huntrule

Suspicious Windows Defender Exclusions Added (via windefend)

This rule detects the Setting of Windows Defender Exclusions

SigmamediumWindowsv1
sigma
title: Suspicious Windows Defender Exclusions Added (via windefend)
id: 0ed4d42e-d39f-5902-806e-2e7ac3c10067
status: stable
description: This rule detects the Setting of Windows Defender Exclusions
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://twitter.com/_nullbind/status/1204923340810543109
author: Huntrule Team
date: 2026-05-21
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    service: windefend
detection:
    selection:
        EventID: 5007
        NewValue|contains: '\Microsoft\Windows Defender\Exclusions'
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.