New addition to Windows Defender exclusion list

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour
Required Data	XDR Agent
ATT&CK Tactic	Stealth (TA0005), Defense Impairment (TA0112)
ATT&CK Technique	Hide Artifacts: File/Path Exclusions (T1564.012), Disable or Modify Tools (T1685)
Severity	Low

Description

Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.

Attacker's Goals

Gain code execution on the host and evade security controls.

Investigative actions

• Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
• Check the excluded object type (process, path or extension) and nature.
• Check if the excluded object is malicious.

Variations

New addition to Windows Defender exclusion list from an unsigned process

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Defense Impairment (TA0112)
ATT&CK Technique	Hide Artifacts: File/Path Exclusions (T1564.012), Disable or Modify Tools (T1685)
Severity	Medium

Description

Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.

Attacker's Goals

Gain code execution on the host and evade security controls.

Investigative actions

• Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
• Check the excluded object type (process, path or extension) and nature.
• Check if the excluded object is malicious.