Folder Removed From Exploit Guard ProtectedFolders List - Registry
Detects the removal of folders from the "ProtectedFolders" list within Windows Defender Exploit Guard's Controlled Folder Access feature. This action could indicate an attacker attempting to bypass security controls to launch an encryption process, manipulate data within a protected folder, or otherwise impair defenses.
Sigma
