Defender exclusion added for TEMP, C:\ root, or .exe/.msi extensions

Ethan Andrews@eandrews

•updated Aug 4, 2026•3•0•7

Detects Add-MpPreference invocations that add a Windows Defender exclusion for the TEMP folder, the C:\ root drive, or the .exe/.msi file extensions, a technique used to blind Defender ahead of malicious MSI/EXE installation.