Defender Root Drive Exclusion

Elgonad .@elgonad

•updated Apr 27, 2026•1•0•171

Detects the use of the Add-MpPreference cmdlet to add the root C:\ drive to the Windows Defender exclusion path. Attackers and ransomware families, such as The Gentlemen, use this technique to completely blind Windows Defender to malicious file activity during the encryption process.