huntrule

Windows Security Event: Handle Write Access Requested on Defender Exclusions Registry Keys

Alerts on registry access requests with write/append permissions to Windows Defender exclusions key paths.

FreeUnreviewedSigmamediumv1
title: "Windows Security Event: Handle Write Access Requested on Defender Exclusions Registry Keys"
id: 5b3c7933-64ee-4923-93ee-d3cbfd9e243c
related:
  - id: 46a68649-f218-4f86-aea1-16a759d81820
    type: derived
  - id: a33f8808-2812-4373-ae95-8cfb82134978
    type: derived
  - id: e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d
    type: derived
status: test
description: This rule flags Windows Security auditing events where a requested handle includes write-related access (WriteData or AppendData) to registry paths under \\Microsoft\\Windows Defender\\Exclusions\\. Attackers may use Defender exclusion modifications to reduce or bypass security inspection, making write attempts to these keys a meaningful defense-impairment signal. It relies on Windows Security logs (EventID 4656 and 4663) that capture object access requests and use SACL auditing for registry system access.
references:
  - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml
author: "@BarryShooshooga, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2019-10-26
modified: 2023-11-11
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User"
detection:
  selection:
    AccessList|contains:
      - "%%4417"
      - "%%4418"
    EventID:
      - 4656
      - 4663
    ObjectName|contains: \Microsoft\Windows Defender\Exclusions\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows Security auditing events where a requested handle includes write-related access (WriteData or AppendData) to registry paths under \\Microsoft\\Windows Defender\\Exclusions\\. Attackers may use Defender exclusion modifications to reduce or bypass security inspection, making write attempts to these keys a meaningful defense-impairment signal. It relies on Windows Security logs (EventID 4656 and 4663) that capture object access requests and use SACL auditing for registry system access.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.