Windows Defender Exclusion Registry Modification
This rule detects modifications to Windows Defender exclusion paths in the registry. Adversaries may modify these registry keys to add exclusions for their malicious files or processes, allowing them to evade detection by Windows Defender. The rule specifically looks for changes to the 'Exclusions\Paths', 'Exclusions\Processes', and 'Exclusions\Extensions' keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender.
Microsoft Sentinel (KQL)
