Windows Defender Exploit Guard Tamper

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.