Sigma rule: Windows Defender Exploit Guard Tamper

Rule

Title

Windows Defender Exploit Guard Tamper

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-05

Modified

2022-12-06

File

rules/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"

Log source

product

windows

service

windefend

Detection

allowed_apps_key:
    EventID: 5007 # The antimalware platform configuration changed.
    NewValue|contains: '\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\'
allowed_apps_path:
    NewValue|contains:
        # Add more paths you don't allow in your org
        - '\Users\Public\'
        - '\AppData\Local\Temp\'
        - '\Desktop\'
        - '\PerfLogs\'
        - '\Windows\Temp\'
protected_folders:
    EventID: 5007 # The antimalware platform configuration changed.
    # This will trigger on any folder removal. If you experience FP's then add another selection with specific paths
    OldValue|contains: '\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\'
condition: all of allowed_apps* or protected_folders

False positives (as the rule lists them)

• Unlikely

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml