Gentlemen Ransomware Adds Broad Defender Exclusion Paths

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•5

Detects the addition of broad exclusion paths to Microsoft Defender, specifically targeting drive roots, administrative shares, or common working directories. This activity is often associated with ransomware, such as the 'Gentlemen Ransomware', to evade detection.