PowerShell Add-MpPreference/Set-MpPreference Defender Exclusion Configuration

Duo Tech@duotech

•updated Jul 9, 2026•4•0•5

Detects attempts to disable or modify Microsoft Defender Antivirus security settings through PowerShell commands (Set-MpPreference/Add-MpPreference) or by modifying Windows Registry keys related to Defender exclusions. Attackers often use these techniques to bypass security controls and prevent detection of malicious files or processes.