Windows Security Log: Windows Defender Exclusions Registry Key Value Modified

Alerts on registry value changes under the Windows Defender Exclusions key in Windows Security event 4657.

FreeUnreviewedSigmamediumv1

windows-security-log-windows-defender-exclusions-registry-key-value-modified-46a68649

title: "Windows Security Log: Windows Defender Exclusions Registry Key Value Modified"
id: e0cfc5d6-4b2c-4dcc-87c4-07a368d74043
related:
  - id: e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d
    type: derived
  - id: a33f8808-2812-4373-ae95-8cfb82134978
    type: derived
  - id: 46a68649-f218-4f86-aea1-16a759d81820
    type: derived
status: test
description: This rule flags registry value modifications to the Windows Defender exclusions path by matching Security event 4657 where the object name contains '\\Microsoft\\Windows Defender\\Exclusions\\'. Changing exclusions can reduce or disable Defender inspection for targeted files, folders, or paths, which is a common defense-evasion step. It relies on Windows Security auditing for Registry System Access Control (SACL) events that report modified registry values.
references:
  - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml
author: "@BarryShooshooga, Huntrule Team"
date: 2019-10-26
modified: 2023-11-11
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User"
detection:
  selection:
    EventID: 4657
    ObjectName|contains: \Microsoft\Windows Defender\Exclusions\
  condition: selection
falsepositives:
  - Intended exclusions by administrators
level: medium
license: DRL-1.1

What it detects

This rule flags registry value modifications to the Windows Defender exclusions path by matching Security event 4657 where the object name contains '\\Microsoft\\Windows Defender\\Exclusions\\'. Changing exclusions can reduce or disable Defender inspection for targeted files, folders, or paths, which is a common defense-evasion step. It relies on Windows Security auditing for Registry System Access Control (SACL) events that report modified registry values.

Known false positives

Intended exclusions by administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.