LOLBAS - Powershell - Suspicious Powershell Commands for AV Exclusion/Disablement
Detection Looks for powershell been used to disable AV/Defender within a system or evade detection through excluding drives/files. Actors will use this to bypass defenses or set up file exclusions to allow their custom files/binaries to execute.
Microsoft Sentinel (KQL)
