Windows Defender Exclusions Added
This rule detects when exclusions are added to Windows Defender. Adversaries often add exclusions to security software to prevent their malicious tools and activities from being detected. This specific rule looks for Event ID 5007, which indicates a change in the antimalware platform configuration, and checks if the new configuration value contains the string '\Microsoft\Windows Defender\Exclusions'. This indicates that a path or file has been added to Windows Defender's exclusion list.
Sigma
