Suspicious Windows Defender Exclusion Added via PowerShell

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects the use of the Add-MpPreference PowerShell cmdlet to add the entire C:\ drive or powershell.exe to Microsoft Defender exclusions. This technique is actively used by threat actors to bypass antivirus scanning and ensure the execution of subsequent payloads.