Defender PUA and Enterprise Edition Checks
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
Cortex XDR
