File written into a default OS antivirus exclusion path

Siemphony@siemphonylowT1564.012unverifiedPlaybook · Defence evasion

AN0139's `ExcludedPaths` knob is explicitly org-customizable — the brief cannot supply what a given estate has excluded — so this rule cannot detect a site's actual AV configuration. What it can detect is the narrower and still-real case the technique's own citation names: adversaries dropping payloads into directories Microsoft documents as default or commonly recommended antivirus exclusions on Windows, on the assumption that most estates leave those defaults untouched. The path list here is deliberately short and checked against Microsoft's own current documentation rather than general folklore: `SoftwareDistribution\Datastore` and `Security\Database` are confirmed Microsoft Defender **built-in** exclusions (Microsoft Learn, "Exclusions in Microsoft Defender Antivirus" — the individual `*.edb`/ `*.chk`/`*.log` files under those folders are excluded automatically on every Windows version, with no configuration); `SoftwareDistribution\Download` and `System Volume Information`/`$Recycle.Bin` are commonly recommended exclusions in AV vendor and IT-forum guidance but are not themselves in Microsoft's built-in list for an ordinary client, so they are weaker evidence and are kept only because they are still real, frequently-cited candidates. An earlier draft of this scaffold also included `System32\catroot2`, on the same "commonly excluded" assumption — that was checked against Microsoft's own "Exclusions to avoid in Microsoft Defender Antivirus and Defender for Endpoint" page and is wrong: Microsoft lists `C:\Windows\System32\CatRoot2` explicitly as a folder **not** to exclude, precisely because attackers abuse it, and it has been removed from the selection below rather than left in on a false premise. The analytic's `ProcessAllowlist` knob is not applied, because the OS processes that legitimately write to these paths (`TrustedInstaller.exe`, `svchost.exe`, `MoUsoCoreWorker.exe`) are also exactly the processes an adversary would need to impersonate or inject into to blend in, so gating on `Image` would suppress the interesting case along with the noise; the brief's other AN0139 leg (Security 4663/4670/4656) is a separate `ObjectName`/`ProcessName` feed with its own field names and is not combined here. Sysmon is not installed by default, and a shipped configuration has to include these paths under a `file_event` rule or the rule returns zero rows. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0051, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: File written into a default OS antivirus exclusion path2id: 498332a4-6bf7-499e-acfb-a75bf16c82ca3status: experimental4description: |5  AN0139's `ExcludedPaths` knob is explicitly org-customizable — the brief6  cannot supply what a given estate has excluded — so this rule cannot detect7  a site's actual AV configuration. What it can detect is the narrower and8  still-real case the technique's own citation names: adversaries dropping9  payloads into directories Microsoft documents as default or commonly10  recommended antivirus exclusions on Windows, on the assumption that most11  estates leave those defaults untouched. The path list here is deliberately12  short and checked against Microsoft's own current documentation rather than13  general folklore: `SoftwareDistribution\Datastore` and `Security\Database`14  are confirmed Microsoft Defender **built-in** exclusions (Microsoft Learn,15  "Exclusions in Microsoft Defender Antivirus" — the individual `*.edb`/16  `*.chk`/`*.log` files under those folders are excluded automatically on17  every Windows version, with no configuration); `SoftwareDistribution\Download`18  and `System Volume Information`/`$Recycle.Bin` are commonly recommended19  exclusions in AV vendor and IT-forum guidance but are not themselves in20  Microsoft's built-in list for an ordinary client, so they are weaker21  evidence and are kept only because they are still real, frequently-cited22  candidates. An earlier draft of this scaffold also included23  `System32\catroot2`, on the same "commonly excluded" assumption — that was24  checked against Microsoft's own "Exclusions to avoid in Microsoft Defender25  Antivirus and Defender for Endpoint" page and is wrong: Microsoft lists26  `C:\Windows\System32\CatRoot2` explicitly as a folder **not** to exclude,27  precisely because attackers abuse it, and it has been removed from the28  selection below rather than left in on a false premise. The29  analytic's `ProcessAllowlist` knob is not applied, because the OS processes30  that legitimately write to these paths (`TrustedInstaller.exe`,31  `svchost.exe`, `MoUsoCoreWorker.exe`) are also exactly the processes an32  adversary would need to impersonate or inject into to blend in, so gating33  on `Image` would suppress the interesting case along with the noise; the34  brief's other AN0139 leg (Security 4663/4670/4656) is a separate35  `ObjectName`/`ProcessName` feed with its own field names and is not36  combined here. Sysmon is not installed by default, and a shipped37  configuration has to include these paths under a `file_event` rule or the38  rule returns zero rows.39  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0051, not hand-written and not tested by its author. Any lab result is on this rule's own page.40references:41  - https://attack.mitre.org/techniques/T1564/01242  - https://attack.mitre.org/detectionstrategies/DET005143author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)44date: 2026-08-1645tags:46  - attack.defense-evasion47  - attack.t1564.01248logsource:49  category: file_event50  product: windows51detection:52  selection:53    TargetFilename|contains:54      - '\Windows\SoftwareDistribution\Datastore\'55      - '\Windows\SoftwareDistribution\Download\'56      - '\Windows\Security\Database\'57      - '\System Volume Information\'58      - '\$Recycle.Bin\'59  condition: selection60falsepositives:61  - "Windows Update writing update payloads, catalog data and driver packages into SoftwareDistribution\\Datastore and \\Download during every routine patch cycle, which is the highest-volume source of matches here on any host with automatic updates enabled."62  - "System Restore and the Volume Shadow Copy service writing restore points and change journals into System Volume Information on every volume that has System Protection enabled, on a schedule independent of any single file operation."63  - "Ordinary users and applications deleting files through Explorer or the recycle API, which relocates the deleted file into $Recycle.Bin and is the single most common non-adversarial source of file-creation events in this path list."64level: low

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (FolderPath contains "\\Windows\\SoftwareDistribution\\Datastore\\" or FolderPath contains "\\Windows\\SoftwareDistribution\\Download\\" or FolderPath contains "\\Windows\\Security\\Database\\" or FolderPath contains "\\System Volume Information\\" or FolderPath contains "\\$Recycle.Bin\\")

Splunk · SPL

Run this as a search.

index=* (TargetFilename="*\\Windows\\SoftwareDistribution\\Datastore\\*" OR TargetFilename="*\\Windows\\SoftwareDistribution\\Download\\*" OR TargetFilename="*\\Windows\\Security\\Database\\*" OR TargetFilename="*\\System Volume Information\\*" OR TargetFilename="*\\$Recycle.Bin\\*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*\\\\windows\\\\softwaredistribution\\\\datastore\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\softwaredistribution\\\\download\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\security\\\\database\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\system volume information\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\$recycle.bin\\\\*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\\Windows\\SoftwareDistribution\\Datastore\\|\\Windows\\SoftwareDistribution\\Download\\|\\Windows\\Security\\Database\\|\\System Volume Information\\|\\\$Recycle\.Bin\\)</field>    <description>File written into a default OS antivirus exclusion path</description>    <mitre>      <id>T1564.012</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: low
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 498332a4-6bf7-499e-acfb-a75bf16c82ca

ATT&CKT1564.012

T1564.012File/Path Exclusions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.012, evaluated against their file_event events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add a NOT selection on the known-legitimate writer processes for Windows-Update-driven paths specifically (TrustedInstaller.exe, svchost.exe, MoUsoCoreWorker.exe) — this is safe for the two Update-owned paths precisely because impersonation risk is lower there than for the security-database path. Drop $Recycle.Bin entirely if its volume swamps triage; it is the weakest of the five and adds little beyond "a file was deleted." Pull your organization's actual AV exclusion list (the real ExcludedPaths MITRE's knob points at) and extend the selection with it — that is where this rule becomes site-specific instead of generic. Cross- reference hits against FileCreationTime versus known update-cycle windows before triaging as suspicious.

Declared by the author

Windows Update writing update payloads, catalog data and driver packages into SoftwareDistribution\Datastore and \Download during every routine patch cycle, which is the highest-volume source of matches here on any host with automatic updates enabled.
System Restore and the Volume Shadow Copy service writing restore points and change journals into System Volume Information on every volume that has System Protection enabled, on a schedule independent of any single file operation.
Ordinary users and applications deleting files through Explorer or the recycle API, which relocates the deleted file into $Recycle.Bin and is the single most common non-adversarial source of file-creation events in this path list.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

A file created under one of a short list of Windows paths that are documented, or commonly recommended, as antivirus exclusions — the idea being that an adversary who assumes most estates leave defaults untouched drops a payload where the AV engine is configured never to look. AN0139's own ExcludedPaths knob is explicitly org-customizable, so no brief can supply what a given estate has actually excluded; this rule detects the narrower, checkable case instead: writes into paths Microsoft itself documents, not a guess at your local configuration.

02 · Telemetry you need

category: file_event, product: windows — Sysmon EventID 11. Sysmon is not installed by default, and a shipped configuration has to explicitly include these paths under a file_event rule or this returns zero rows regardless of what happened on disk. The brief's other AN0139 leg (Security 4663/4670/4656) is a structurally different feed with its own ObjectName/ProcessName fields and is not combined here.

03 · How the logic works

One selection, five path fragments, TargetFilename|contains:

The five entries are not equally sourced, and the description says so: SoftwareDistribution\Datastore and Security\Database are confirmed Microsoft Defender built-in exclusions per Microsoft Learn's "Exclusions in Microsoft Defender Antivirus" — automatic on every Windows install, no configuration needed. SoftwareDistribution\Download, System Volume Information and $Recycle.Bin are common AV-vendor and IT-forum exclusion recommendations, not Microsoft's confirmed built-in list — weaker evidence, kept because they are still real and frequently cited. A sixth path, System32\catroot2, was in an earlier draft on the same "commonly excluded" logic and was wrong: Microsoft's own "Exclusions to avoid" guidance names CatRoot2 explicitly as a folder attackers abuse and tells admins not to exclude it. It has been removed rather than left in on a false premise — a reminder that "commonly recommended" and "actually Microsoft's default" are different claims and this rule tries to keep them separate. AN0139's ProcessAllowlist knob is deliberately not applied. Gating on Image (e.g., allow only TrustedInstaller.exe, svchost.exe, MoUsoCoreWorker.exe) would suppress exactly the interesting case, since those are the processes an adversary would need to impersonate or inject into to blend in — allowlisting them filters out the attack along with the noise.

04 · Common false positives

Windows Update is the dominant source by far: routine patch cycles write update payloads, catalog data and driver packages into SoftwareDistribution\Datastore and \Download on every host with automatic updates enabled, and this rule cannot distinguish that from a payload drop in the same folder. System Restore and Volume Shadow Copy write restore points and change journals into System Volume Information on their own schedule wherever System Protection is on. Ordinary users deleting files through Explorer or the recycle API relocate them into $Recycle.Bin constantly — this is likely the single most common non-adversarial trigger of the five. level: low matches this volume.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0051 and never run against a log line. The path list mixes confirmed Microsoft defaults with unconfirmed but plausible community recommendations, and that distinction is stated but unverified against real telemetry.
tier_2: needs your own Sysmon EID11 volume from these five paths to see whether Update and Restore noise can be filtered by writer process without losing the signal, and to add your actual site exclusion list.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/498332a4-6bf7-499e-acfb-a75bf16c82ca

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@tomas-eriksen
28 Aug 2026
Dropping catroot2 after checking it against Microsoft's own "exclusions to avoid" page is the detail that made me trust the rest of this corpus. It is in half the rule sets in the wild, carried along on folklore, and Microsoft explicitly lists it as a folder not to exclude precisely because attackers abuse it. Removing a plausible-looking selector because the source says otherwise is harder than adding one.

File written into a default OS antivirus exclusion path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread