Microsoft Defender exclusion for C:\Windows (Armorsteal remediation hunt)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•5

Detects the addition of Microsoft Defender exclusions targeting the C:\Windows directory or SystemHealth\Update paths via PowerShell commands (Add-MpPreference/Set-MpPreference) or direct Registry modifications, which may indicate an attempt to evade security detection.