SYSTEM-Level Scheduled Task Persisting Defender Exclusion via Add-MpPreference

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects the creation of a scheduled task configured to run under the SYSTEM account that executes a command to add a Windows Defender exclusion using Add-MpPreference. This technique is often used to ensure persistence of security exclusions by re-applying them automatically with high privileges, even if an interactive user attempts to remove them.