Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Hunt Hypothesis

Detects the usage of “reg.exe” to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Detection Rule

Sigma (Original)

title: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
id: 48917adc-a28e-4f5d-b729-11e75da8941f
status: test
description: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.
references:
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
    - https://redcanary.com/threat-detection-report/threats/qbot/
author: frack113
date: 2022-02-13
modified: 2023-02-04
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\reg.exe'
        CommandLine|contains:
            - 'SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'
            - 'SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths'
        CommandLine|contains|all:
            - 'ADD '
            - '/t '
            - 'REG_DWORD '
            - '/v '
            - '/d '
            - '0'
    condition: selection
falsepositives:
    - Legitimate use
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessName endswith "\\reg.exe" and (TargetProcessCommandLine contains "SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" or TargetProcessCommandLine contains "SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths") and (TargetProcessCommandLine contains "ADD " and TargetProcessCommandLine contains "/t " and TargetProcessCommandLine contains "REG_DWORD " and TargetProcessCommandLine contains "/v " and TargetProcessCommandLine contains "/d " and TargetProcessCommandLine contains "0")

Required Data Sources

False Positive Guidance

• Legitimate use

MITRE ATT&CK Context

• Technique: T1685 — T1685

References

• https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
• https://redcanary.com/threat-detection-report/threats/qbot/
• SigmaHQ Rule