Detect Defender exclusions rules and ASR rules
Closed this issue · 2 comments
nodauf commented
From this tweet it is possible to enumerate Windows Defender's exclusions by listing the event ID 5007.
For example, whitelisting cmd.exe generates the following event
The tool https://github.com/0xsp-SRD/MDE_Enum already implement this finding and also enumerates the event ID 1121 to retrieve the ASR rules that have matched.
itm4n commented
Good idea! Will see what I can do. 🙂