Disable Exploit Guard Network Protection on Windows Defender

Title: Disable Exploit Guard Network Protection on Windows Defender
Status: test
Description:Detects disabling Windows Defender Exploit Guard Network Protection
References:
  -https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html
Author: Austin Songer @austinsonger
Date: 2021-08-04
modified:2023-08-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: 'SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride'
    Details: 'DWORD (00000001)'
  condition:selection
Falsepositives:
  -Unknown
Level: medium