Windows Defender Exclusion Registry Key - Write Access Requested

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2024•2•0•26

This rule detects attempts to request write access to Windows Defender exclusion registry keys. This activity is highly suspicious as it could indicate an attacker attempting to modify or add new exclusions to bypass antivirus protection. The rule specifically looks for Event IDs 4656 (handle requested) or 4663 (object access attempt) in conjunction with write-related access rights (WriteData or AppendData) on registry paths containing '\Microsoft\Windows Defender\Exclusions\'.