PowerShell Defender exclusions for working and temp dirs (Metro4Shell loader)

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•6

Detects the addition of Windows Defender exclusions using PowerShell (either in clear text or via encoded command launched from cmd.exe) referencing common temporary or working directories, potentially indicating an attempt to hide malicious files.