Defender Exclusion Additions for TEMP Paths and Dropped Binaries (WinDefCtl)

Duo Tech@duotech

•updated Jul 9, 2026•2•0•5

This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.