CRUDEEXCLUDE Defender Exclusion Path via PowerShell

Ibrahim Saud@tektrix

•updated 21 days ago•1•0•6

Detects the addition of exclusion paths to Microsoft Defender via PowerShell (Add-MpPreference or Set-MpPreference) initiated by non-Microsoft signed processes or specific messaging applications. This behavior is often indicative of malware attempting to exclude malicious payloads from security scanning.