PowerShell Defender Exclusion Path/Process Tampering (Add-MpPreference/Set-MpPreference)

Duo Tech@duotech

•updated Jul 2, 2026•2•0•2

Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.