Windows Defender Exclusions Added via PowerShell Script Block Logging

title: Windows Defender Exclusions Added via PowerShell Script Block Logging
id: dcef8f30-f5c7-4faa-9963-25249c9cdf2f
related:
  - id: 17769c90-230e-488b-a463-e05c08e9d48f
    type: similar
  - id: c1344fa2-323b-4d2e-9176-84b4d4821c88
    type: derived
status: test
description: This rule identifies PowerShell script activity that modifies Windows Defender configuration by adding exclusion settings. Adding exclusions can reduce or bypass endpoint scanning, helping attackers evade detection while maintaining execution. It relies on PowerShell script block telemetry, matching script text that uses Add-MpPreference or Set-MpPreference along with exclusion parameters for paths, extensions, processes, or IP addresses.
references:
  - https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-16
modified: 2022-11-26
tags:
  - attack.defense-impairment
  - attack.t1685
  - attack.execution
  - attack.t1059
logsource:
  category: ps_script
  product: windows
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_args_exc:
    ScriptBlockText|contains:
      - " -ExclusionPath "
      - " -ExclusionExtension "
      - " -ExclusionProcess "
      - " -ExclusionIpAddress "
  selection_args_pref:
    ScriptBlockText|contains:
      - "Add-MpPreference "
      - "Set-MpPreference "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1