PowerShell Adding Windows Defender Exclusions

Tim Peck@timpeck

•updated Jan 16, 2026•15•3•172

Detects the use of PowerShell to add exclusions to Windows Defender. This technique was observed in the PHALT#BLYX campaign where attackers added exclusions for the 'C:\ProgramData' directory and for file extensions like '.exe', '.ps1', and '.proj' to prevent their malware from being detected.