Ransomware Series: Nova/Gentlemen Ransomware Add-MpPreference ExclusionPath for

Ibrahim Saud@tektrix

•updated 11 days ago•3•0•1

Detects the use of PowerShell to modify Microsoft Defender exclusion paths by adding root drive letters or temporary directory paths. This behavior is indicative of defense evasion techniques often employed by ransomware families, such as Nova or Gentlemen, to prevent the scanning of files immediately prior to encryption.