PowerShell Defender Exclusion Modification

F S@Fsdr

•updated Mar 31, 2026•8•0•137

Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.