AN0139
Analytic 0139
Windows
Creation or modification of files in directories known to be excluded from AV scanning (e.g., C:\Windows\Temp, Exchange server directories, or default AV exclusions). Defender perspective: correlate file creation with execution behavior or anomalous parent processes writing to excluded paths.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=4663, 4670, 4656
[ExcludedPaths]
List of directories excluded from scanning in the environment (customizable per organization).
[ProcessAllowlist]
Legitimate processes typically writing to excluded paths to minimize false positives.
AN0140
Analytic 0140
Linux
Adversaries writing or moving payloads into directories configured as AV/EDR exclusion paths (e.g., /tmp, /var/lib, or custom directories from auditd exclusion rules). Defender perspective: detect file creation in paths matching known exclusions correlated with unusual parent processes.
auditd:SYSCALL
open or creat syscalls targeting excluded paths
auditd:PATH
file path matches exclusion directories
[ExcludedDirectories]
System- or security-tool-configured exclusion directories where files should rarely change.
[CorrelationWindow]
Time window to correlate file creation in excluded paths with execution or network activity.
AN0141
Analytic 0141
macOS
Suspicious file creation or modification in directories ignored by XProtect or AV exclusions (e.g., ~/Library, temporary cache directories). Defender perspective: monitor file events in ignored paths with correlation to execution or persistence activity.
macos:unifiedlog
file creation in AV exclusion directories
macos:unifiedlog
process writes or modifies files in excluded paths
[AVExclusionPaths]
Paths ignored by AV/XProtect that should be monitored for abnormal writes.
[ProcessContext]
Expected user or application context writing to excluded directories.