Defense Evasion - Add-MpPreference Targeting User or Temp via PowerShell

Marcus Mingo@meeengoh

•updated Jul 6, 2025•1•2•35

Detects suspicious use of Add-MpPreference via PowerShell where exclusions are added to Users or Temp directories — common evasion technique to bypass Defender scans.