KQL Search

Query Details

Defender Exclusions

Query

//Monitor changes in exclusions for Windows Defender

DeviceRegistryEvents 
| where ((ActionType == "RegistryValueSet") and (RegistryKey startswith @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" 
or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions"
or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes"))

Explanation

This query is used to monitor changes in exclusions for Windows Defender. It looks for registry events where the action type is "RegistryValueSet" and the registry key starts with specific paths related to Windows Defender exclusions.