Cryptominer Adding Windows Defender Exclusions

Detects Windows Defender exclusion modifications. The malicious Hola miner was observed adding exclusions before beginning mining operations.

Microsoft Sentinel (KQL)