PowerShell Adds Windows Defender Exclusions via Add-MpPreference/Set-MpPreference
Flags PowerShell commands that add Windows Defender exclusions using Add-MpPreference/Set-MpPreference with exclusion parameters.
- Product
- windows
- Category
- ps_script
- Author
- Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-16
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell activity that adds or updates Windows Defender exclusion settings by matching script content containing Add-MpPreference or Set-MpPreference along with exclusion parameters (path, extension, process, or IP address). Attackers often use Defender exclusions to reduce visibility and hinder detection of subsequent malicious activity. It relies on PowerShell script block text telemetry (e.g., script block logging) to match the relevant command and exclusion arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Adds Windows Defender Exclusions via Add-MpPreference/Set-MpPreference
id: dcef8f30-f5c7-4faa-9963-25249c9cdf2f
related:
- id: 17769c90-230e-488b-a463-e05c08e9d48f
type: similar
- id: c1344fa2-323b-4d2e-9176-84b4d4821c88
type: derived
status: test
description: This rule identifies PowerShell activity that adds or updates Windows Defender exclusion settings by matching script content containing Add-MpPreference or Set-MpPreference along with exclusion parameters (path, extension, process, or IP address). Attackers often use Defender exclusions to reduce visibility and hinder detection of subsequent malicious activity. It relies on PowerShell script block text telemetry (e.g., script block logging) to match the relevant command and exclusion arguments.
references:
- https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-16
modified: 2022-11-26
tags:
- attack.defense-impairment
- attack.t1685
- attack.execution
- attack.t1059
logsource:
category: ps_script
product: windows
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_args_exc:
ScriptBlockText|contains:
- " -ExclusionPath "
- " -ExclusionExtension "
- " -ExclusionProcess "
- " -ExclusionIpAddress "
selection_args_pref:
ScriptBlockText|contains:
- "Add-MpPreference "
- "Set-MpPreference "
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1