Folder Removed From Exploit Guard ProtectedFolders List - Registry

Title: Folder Removed From Exploit Guard ProtectedFolders List - Registry
Status: test
Description:Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
References:
  -https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
modified:2023-02-08
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_delete
• product: windows

Detection:
  selection:
    EventType: 'DeleteValue'
    TargetObject|contains: 'SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders'
  condition:selection
Falsepositives:
  -Legitimate administrators removing applications (should always be investigated)
Level: high