Windows Exploit Guard Controlled Folder Access: Added Allowed Application for Blocked Path

title: "Windows Exploit Guard Controlled Folder Access: Added Allowed Application for Blocked Path"
id: 5dee83b3-23ac-445c-a1c5-cf5ab9d6e0ee
status: test
description: This rule flags registry updates that add an entry under the Exploit Guard Controlled Folder Access AllowedApplications list. Attackers can use this to permit a specific application to write or execute despite controlled folder protections, potentially bypassing restrictions on common user-writable and temporary locations. The detection relies on registry set telemetry where the TargetObject path contains the AllowedApplications key and includes suspicious directory path values.
references:
  - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications
  selection_paths:
    TargetObject|contains:
      - \Users\Public\
      - \AppData\Local\Temp\
      - \Desktop\
      - \PerfLogs\
      - \Windows\Temp\
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 42205c73-75c8-4a63-9db1-e3782e06fda0
    type: derived