Windows Defender Exclusions Added - Registry

Title: Windows Defender Exclusions Added - Registry
Status: test
Description:Detects the Setting of Windows Defender Exclusions
References:
  -https://twitter.com/_nullbind/status/1204923340810543109
Author: Christian Burkard (Nextron Systems)
Date: 2021-07-06
modified:2023-08-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection2:
    TargetObject|contains: '\Microsoft\Windows Defender\Exclusions'
  condition:selection2
Falsepositives:
  -Administrator actions
Level: medium