PowerShell Add-MpPreference Windows Defender exclusion for entire C:\ drive
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
Microsoft Sentinel (KQL)
