fix(rules): Remove Windows Defender exceptions

rabbitstack · rabbitstack · commit 76e046973b29 · 2026-04-12T22:11:40.000+02:00
diff --git a/rules/credentail_access_file_access_to_sam_database.yml b/rules/credentail_access_file_access_to_sam_database.yml
@@ -33,8 +33,6 @@ condition: >
               '?:\\Windows\\System32\\vmwp.exe',
               '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe',
               '?:\\Windows\\System32\\wuauclt.exe',
-              '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
-              '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe',
               '?:\\Windows\\System32\\MRT.exe'
             )
 

Original file line number	Diff line number	Diff line change
`@@ -33,8 +33,6 @@ condition: >`
`33`	`33`	`'?:\\Windows\\System32\\vmwp.exe',`
`34`	`34`	`'?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe',`
`35`	`35`	`'?:\\Windows\\System32\\wuauclt.exe',`
`36`		`- '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',`
`37`		`- '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe',`
`38`	`36`	`'?:\\Windows\\System32\\MRT.exe'`
`39`	`37`	`)`
`40`	`38`