Windows Defender Exclusions by Extension

[rule]
description = """
Identifies modifications to the Windows Defender configuration settings to exclude specific executable file types by
extension.
"""
id = "bcd02481-8a8a-4b2b-9c29-647bf08b75b2"
license = "Elastic License v2"
name = "Windows Defender Exclusions by Extension"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps",
]
version = "1.0.13"

query = '''
registry where
 registry.value : ("exe", "pif", "scr", "js", "vbs", "wsh", "hta", "cpl", "jse", "vbe", "bat", "cmd", "dll", "ps?") and
 registry.data.strings : "0" and
 registry.path :
         ("HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Extensions\\*",
          "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Extensions\\*") and
 not (process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
      not process.name : ("reg.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe") and
      not process.executable : "?:\\Windows\\Microsoft.NET\\*")
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"