{"id":"272e55a4-9e6b-4211-acb6-78f51f0b1b40","title":"Folder Removed From Exploit Guard ProtectedFolders List - Registry","description":"Detects the removal of folders from the \"ProtectedFolders\" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-05","modified":"2023-02-08","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"registry_delete","product":"windows"},"falsepositives":["Legitimate administrators removing applications (should always be investigated)"],"references":["https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/"],"source_path":"rules/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml","source_sha256":"a8ac4b0844437e078d33b8832032a93e5956025fdccf22c514cff231bfb601eb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Folder Removed From Exploit Guard ProtectedFolders List - Registry\nid: 272e55a4-9e6b-4211-acb6-78f51f0b1b40\nstatus: test\ndescription: Detects the removal of folders from the \"ProtectedFolders\" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder\nreferences:\n    - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-05\nmodified: 2023-02-08\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: registry_delete\n    product: windows\ndetection:\n    selection:\n        EventType: DeleteValue\n        TargetObject|contains: 'SOFTWARE\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\ProtectedFolders'\n    condition: selection\nfalsepositives:\n    - Legitimate administrators removing applications (should always be investigated)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/272e55a4-9e6b-4211-acb6-78f51f0b1b40.json","kind":"sigma"}