Windows Defender Exclusions Added via Windefend Event ID 5007

title: Windows Defender Exclusions Added via Windefend Event ID 5007
id: fe73f424-19eb-4243-9e7d-9e6adf16c553
status: stable
description: This rule identifies when Windows Defender exclusions are added by matching windefend Event ID 5007 where the updated value contains the Defender Exclusions path. Attackers and admins may use exclusions to reduce scanning and weaken host defenses, making configuration-change telemetry important for early detection. It relies on Windows Defender (windefend) events that record antimalware platform configuration changes and the new configuration value.
references:
  - https://twitter.com/_nullbind/status/1204923340810543109
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-07-06
modified: 2022-12-06
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5007
    NewValue|contains: \Microsoft\Windows Defender\Exclusions
  condition: selection
falsepositives:
  - Administrator actions
level: medium
license: DRL-1.1
related:
  - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f
    type: derived