Windows Defender Exclusions Added

Title: Windows Defender Exclusions Added
Status: stable
Description:Detects the Setting of Windows Defender Exclusions
References:
  -https://twitter.com/_nullbind/status/1204923340810543109
Author: Christian Burkard (Nextron Systems)
Date: 2021-07-06
modified:2022-12-06
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• service: windefend

Detection:
  selection:
    EventID: '5007'
    NewValue|contains: '\Microsoft\Windows Defender\Exclusions'
  condition:selection
Falsepositives:
  -Administrator actions
Level: medium