Suspicious Windows Defender Folder Exclusion Added Through Reg.EXE (via process_creation)

title: Suspicious Windows Defender Folder Exclusion Added Through Reg.EXE (via process_creation)
id: 7dc82e87-c073-5be0-b306-59d92599fbe0
status: stable
description: This rule detects the use of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this method to add exclusions for folders within AppData and ProgramData.
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
    - https://redcanary.com/threat-detection-report/threats/qbot/
author: Huntrule Team
date: 2026-05-22
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\reg.exe'
        CommandLine|contains:
            - 'SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'
            - 'SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths'
        CommandLine|contains|all:
            - 'ADD '
            - '/t '
            - 'REG_DWORD '
            - '/v '
            - '/d '
            - '0'
    condition: selection
falsepositives:
    - Unknown
level: medium