Armorsteal xm_handler.py Defender exclusion for C:\Windows and xmrig.exe
Detects the execution of Add-MpPreference or Set-MpPreference to add a Windows Defender exclusion for the C:\Windows path or xmrig.exe process, potentially indicative of defense evasion activities by malware such as Armorsteal.
Microsoft Sentinel (KQL)
