huntrule

Windows: reg.exe Adds Windows Defender Exclusion Paths via Registry Value Update

Detects reg.exe commands that modify Windows Defender/Microsoft Antimalware exclusion path registry entries.

FreeUnreviewedSigmamediumv1
title: "Windows: reg.exe Adds Windows Defender Exclusion Paths via Registry Value Update"
id: 8252ede5-e759-4280-a1df-4c584f097980
status: test
description: This rule flags process executions of reg.exe where the command line targets Defender/Microsoft Antimalware exclusion paths and sets a registry value matching ADD /t REG_DWORD /v /d 0. Attackers can use Defender exclusions to reduce security visibility by preventing scanning of specific directories. The detection relies on Windows process creation telemetry, matching reg.exe invocation and specific registry path and command-line parameters.
references:
  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
  - https://redcanary.com/threat-detection-report/threats/qbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2023-02-04
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \reg.exe
    CommandLine|contains:
      - SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
      - SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
    CommandLine|contains|all:
      - "ADD "
      - "/t "
      - "REG_DWORD "
      - "/v "
      - "/d "
      - "0"
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: 48917adc-a28e-4f5d-b729-11e75da8941f
    type: derived

What it detects

This rule flags process executions of reg.exe where the command line targets Defender/Microsoft Antimalware exclusion paths and sets a registry value matching ADD /t REG_DWORD /v /d 0. Attackers can use Defender exclusions to reduce security visibility by preventing scanning of specific directories. The detection relies on Windows process creation telemetry, matching reg.exe invocation and specific registry path and command-line parameters.

Known false positives

  • Legitimate use

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.