Defender Exclusion Added for C:\Users Followed by Service Restart

Ethan Andrews@eandrews

•updated Jul 24, 2026•14•0•19

Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)