Techniques › T1679 › AN2030
AN2030 Analytic 2030
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A process with no prior history or outside of known whitelisted tools initiates file or registry modifications to configure exclusion rules for antivirus, backup, or file-handling systems. Or a file system enumeration for specific file names andcritical extensions like .dll, .exe, .sys, or specific directories such as 'Program Files' or security tool paths or system component discovery for the exclusion of the files or components.</p>
- Detects
- T1679 Selective Exclusion
- Part of
- DET0897 Detection of Selective Exclusion
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlate multiply discovery activities and file enumeration activities. |
DiscoveryActivityThreshold | Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities) |
ExclusionTargetList | List of extensions or folders considered suspicious when excluded (e.g., .dll, .exe, C:\\Program Files\\) |
AuthorizedExclusionModifiers | Whitelist of known system management tools/processes allowed to modify exclusion settings |