GPO Registry Write for Persistent Defender C:\ Exclusion + gpupdate /force

Ibrahim Saud@tektrix

•updated Sep 20, 2026•2•0•3

This rule detects two potentially malicious activities: the addition of exclusions to Windows Defender using reg.exe, which can be used to hide malicious files from security scanning, and the forceful update of Group Policy using gpupdate.exe with /force and /wait:0, which can be used to propagate malicious policy changes or force re-application of settings.