Suspicious Application Added to Exploit Guard Allowed List
Detects applications being added to the "allowed applications" list of Exploit Guard's Controlled Folder Access feature, specifically when these applications are located in suspicious paths. This action can be used by adversaries to bypass Controlled Folder Access protections and execute malicious code.
Sigma
