T1053.005: Silver Fox SYSTEM Scheduled Task Sets Defender Exclusions

Tim Peck@timpeck

•updated Sep 3, 2026•8•1•22

This rule detects potential attempts to tamper with Microsoft Defender security settings by creating or managing scheduled tasks that modify Defender exclusion paths. It correlates process execution (specifically schtasks.exe or PowerShell commands used for setting exclusions) with Windows Registry events that modify the Microsoft Defender exclusion path registry keys, flagging suspicious activity within a 15-minute window.