Defender AV exclusion added via PowerShell (Add/Set-MpPreference)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•2•0•5

Detects the use of PowerShell cmdlets (Add-MpPreference or Set-MpPreference) to modify Microsoft Defender exclusions (paths, processes, or extensions). This behavior is often associated with adversaries attempting to evade security detection by excluding malicious files or processes from being scanned by Microsoft Defender.