Defender exclusion registry entries added for C:\Drivers, vssvc.exe, ctfmon.exe

Kaung Khant Ko@kaungkhantko

•updated Aug 28, 2026•4•0•8

Detects modifications to Windows Defender registry keys responsible for exclusions. Specifically monitors when paths or processes associated with potentially suspicious locations (like C:\Drivers) or common system binaries (VSSVC.exe, ctfmon.exe, C:\Windows\System32) are added to the Defender exclusion list. This is a common technique used by attackers to hide malicious files or activity from antivirus scanning.