Defender Exclusion Added for AppData via PowerShell

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects the use of PowerShell to modify Microsoft Defender settings to add an exclusion path within the AppData directory. This behavior is often associated with malware or threat actors attempting to whitelist malicious payloads to evade security scanning.