Windows Defender Exploit Guard Tamper via ProtectedFolders or AllowedApplications Changes

title: Windows Defender Exploit Guard Tamper via ProtectedFolders or AllowedApplications Changes
id: 91d21ac2-3104-47c7-9870-cd51e4de5bec
status: test
description: This rule flags Windows Defender Exploit Guard configuration changes involving Controlled Folder Access lists of ProtectedFolders and AllowedApplications. Attackers may tamper with these lists to allow unwanted execution paths or remove folders from protection, reducing containment. It relies on Windefend telemetry for EventID 5007 and inspects old/new values for changes to the Controlled Folder Access registry paths.
references:
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2022-12-06
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  allowed_apps_key:
    EventID: 5007
    NewValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\
  allowed_apps_path:
    NewValue|contains:
      - \Users\Public\
      - \AppData\Local\Temp\
      - \Desktop\
      - \PerfLogs\
      - \Windows\Temp\
  protected_folders:
    EventID: 5007
    OldValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\
  condition: all of allowed_apps* or protected_folders
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a3ab73f1-bd46-4319-8f06-4b20d0617886
    type: derived