Folder Removed From Exploit Guard ProtectedFolders List - Registry
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry entry deleted" AND ACCESSES = "DeleteValue" AND (OBJECTNAME contains "SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders" OR (OBJECTNAME endswith "SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" AND OBJECTVALUENAME startswith "ProtectedFolders")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.OBJECTNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
