Disable Exploit Guard Network Protection on Windows Defender

calendar Aug 17, 2023 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects disabling Windows Defender Exploit Guard Network Protection

Sigma rule (View on GitHub)

 1title: Disable Exploit Guard Network Protection on Windows Defender
 2id: bf9e1387-b040-4393-9851-1598f8ecfae9
 3status: experimental
 4description: Detects disabling Windows Defender Exploit Guard Network Protection
 5references:
 6    - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html
 7author: Austin Songer @austinsonger
 8date: 2021/08/04
 9modified: 2023/08/17
10tags:
11    - attack.defense_evasion
12    - attack.t1562.001
13logsource:
14    category: registry_set
15    product: windows
16detection:
17    selection:
18        TargetObject|contains: 'SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride'
19        Details: 'DWORD (00000001)'
20    condition: selection
21falsepositives:
22    - Unknown
23level: medium

References

  • How to Enable or Disable Windows Defender Exploit Protection Settings in Windows 10 Starting with Windows 10 build 16232, you can now audit, configure, and manage Windows system and application exp...


    Read More

Related rules

to-top