Disable Exploit Guard Network Protection on Windows Defender

Detects disabling Windows Defender Exploit Guard Network Protection

Sigma rule (View on GitHub)

 1title: Disable Exploit Guard Network Protection on Windows Defender
 2id: bf9e1387-b040-4393-9851-1598f8ecfae9
 3status: test
 4description: Detects disabling Windows Defender Exploit Guard Network Protection
 5references:
 6    - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html
 7author: Austin Songer @austinsonger
 8date: 2021/08/04
 9modified: 2023/08/17
10tags:
11    - attack.defense_evasion
12    - attack.t1562.001
13logsource:
14    category: registry_set
15    product: windows
16detection:
17    selection:
18        TargetObject|contains: 'SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride'
19        Details: 'DWORD (00000001)'
20    condition: selection
21falsepositives:
22    - Unknown
23level: medium

References

Related rules

to-top