huntrule

Suspicious Windows Defender Exclusion Added via PowerShell Add-MpPreference

PremiumReviewedSigma · Medium · v1
Category
process_creation
Author
HuntRule
Published
2026-09-29
Updated
2026-09-29
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell using Add-MpPreference to register a Windows Defender exclusion, observed during post-exploitation of CrushFTP servers by Huntress. Attackers add path or process exclusions to prevent detection of tooling staged under directories such as Windows Temp. Disabling protection coverage before dropping payloads is a common defense-evasion precursor, so unexpected exclusion changes warrant review.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell AMSI or ETW Tampering
Custom Cobalt Strike Command Execution
Malicious Windows Defender Real-Time Monitoring Disabled via PowerShell
Malicious AMSI Bypass via AmsiUtils amsiInitFailed Manipulation
Malicious ELAM Driver Disable via Bcdedit
Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit
Suspicious PowerShell Out-of-Band Request to Interactsh Domain
Suspicious Curl Download Spawned by PowerShell
Suspicious Command Interpreter Spawned by Cleo Java Process
Suspicious Windows Defender Exclusion Added via PowerShell Add-MpPreference
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.