Defender Exclusion Added via PowerShell

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•11

Identifies attempts to exclude the C drive or powershell from Defender scanning, often associated with malware like AsyncRAT. The rule specifically looks for PowerShell commands using 'Add-MpPreference' with '-ExclusionPath' or '-ExclusionProcess' targeting 'C:\' or 'powershell.exe'.