PowerShell Defender Exclusion Configuration
Detects the use of PowerShell cmdlets 'Add-MpPreference' or 'Set-MpPreference' in conjunction with parameters like '-ExclusionPath', '-ExclusionExtension', '-ExclusionProcess', or '-ExclusionIpAddress' to configure exclusions for Microsoft Defender Antivirus. This activity is often associated with defense evasion tactics used by adversaries to prevent security software from detecting their malicious activities.
Sigma
