All Detections

PowerShell adding exclusion path for Microsoft Defender of ProgramData

Azure Sentinel@AzureSentinel
updated Jun 17, 202507

Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor.

Microsoft Sentinel (KQL)