Suspicious Application Allowed Through Exploit Guard

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1562.001` Impair Defenses: Disable or Modify Tools

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `all of selection_key`

TargetObject|contains: 'SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications'

Stage 2: `all of selection_paths`

or:
TargetObject|contains: '\AppData\Local\Temp\'
TargetObject|contains: '\Desktop\'
TargetObject|contains: '\PerfLogs\'
TargetObject|contains: '\Users\Public\'
TargetObject|contains: '\Windows\Temp\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`TargetObject`	match	`SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications` `\AppData\Local\Temp\` `\Desktop\` `\PerfLogs\` `\Users\Public\` `\Windows\Temp\`