Defender exclusion added via PowerShell for SoftEther C:\Windows\system path

Arnold Chan@slaz

•updated Sep 8, 2026•1•0•2

Detects the use of PowerShell to modify Windows Defender security settings by adding exclusion paths or processes. This behavior is indicative of an adversary attempting to whitelist malicious files or processes to evade detection by the antivirus solution.