Hidden PowerShell adds AppData to Defender exclusions

Arnold Chan@slaz

•updated 14 days ago•0•0•2

This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.