LOLBAS - Powershell - Suspicious Powershell Commands for File Extension Exclusion
Detection looks for Powershell used with various cmdlets used to add certain filetypes to Defender AV exclusion, they would normally be blocked upon execution in certain ways. Allows an actor to execute their own files that normally would be blocked.
Microsoft Sentinel (KQL)
