LoFP LoFP / possible admin activity

Techniques

Sample rules

Powershell Defender Exclusion

Description

Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets

Detection logic

condition: all of selection*
selection1:
  CommandLine|contains:
  - 'Add-MpPreference '
  - 'Set-MpPreference '
selection2:
  CommandLine|contains:
  - ' -ExclusionPath '
  - ' -ExclusionExtension '
  - ' -ExclusionProcess '
  - ' -ExclusionIpAddress '