AV Exclusion Path Added via Remote Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•5

This rule detects attempts to add an exclusion path to Windows Defender via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS) containing the strings "Exclusions\Paths" and "WindowsDefender" (case-insensitive). This activity could indicate an attacker trying to disable or bypass antivirus protection.