PowerShell Defender Exclusion via Set/Add-MpPreference Command-Line Flags (Windows)

title: PowerShell Defender Exclusion via Set/Add-MpPreference Command-Line Flags (Windows)
id: 006367bc-49b9-4111-9818-8abf664d1f07
related:
  - id: c1344fa2-323b-4d2e-9176-84b4d4821c88
    type: similar
  - id: 17769c90-230e-488b-a463-e05c08e9d48f
    type: derived
status: test
description: This rule flags PowerShell process creation where the command line uses Microsoft Defender cmdlets Add-MpPreference or Set-MpPreference with parameters that configure antivirus exclusions. Attackers can use exclusion settings to reduce detection coverage by causing Defender to skip scanning specific files, extensions, processes, or IP-related items. It relies on Windows process creation telemetry and matches command-line substrings for the relevant Defender exclusion switches.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://twitter.com/AdamTheAnalyst/status/1483497517119590403
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-29
modified: 2022-05-12
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - "Add-MpPreference "
      - "Set-MpPreference "
  selection2:
    CommandLine|contains:
      - " -ExclusionPath "
      - " -ExclusionExtension "
      - " -ExclusionProcess "
      - " -ExclusionIpAddress "
  condition: all of selection*
falsepositives:
  - Possible Admin Activity
  - Other Cmdlets that may use the same parameters
level: medium
license: DRL-1.1