Windows Defender Exploit Protection Override Registry Modification
Detection of registry modifications targeting the DisallowExploitProtectionOverride setting within Windows Defender.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 08:17 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This detection identifies registry modifications where the DisallowExploitProtectionOverride value is set to 0x00000001. This registry change is associated with the configuration of Windows Defender Exploit Protection settings.
Detection Logic
The rule monitors registry_set events for the following path:
SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride
With the value: DWORD (0x00000001)
Detection coverage 1
Detect DisallowExploitProtectionOverride Modification
mediumDetects registry modifications that set the DisallowExploitProtectionOverride value to 0x00000001.
Detection queries are available on the platform. Get full rules →