Windows Defender Exclusions Added via PowerShell
Detects modifications to Windows Defender configuration settings using PowerShell to add exclusions. This activity is often performed by adversaries to disable or bypass security controls, allowing their malicious activities to go undetected.
Sigma
