Add or Set Windows Defender Exclusion

This analytic detects the use of PowerShell commands to add or set exclusions in Windows Defender. It specifically looks for command-line executions containing "Add-MpPreference" or "Set-MpPreference" along with exclusion parameters such as "-Exclusion*", "-ControlledFolderAccessAllowedApplications*", or "-AttackSurfaceReductionOnlyExclusions*". Adversaries commonly use this technique to bypass Windows Defender's protections, allowing malicious code to execute undetected, maintain persistence, and perform further malicious activities without interference from the antivirus.