Windows Defender Exclusion Registry Key - Write Access Requested

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•3

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.