Suspicious Windows Defender Exclusions Added via PowerShell

sequence with maxspan=1m
  [process where event.action == "start" and
   not process.Ext.token.integrity_level_name == "system" and
   (
    (process.code_signature.trusted != true) or
    (process.executable : ("?:\\Windows\\Microsoft.NET\\*",
                           "?:\\Users\\Public\\*",
                           "?:\\Users\\*\\AppData\\Local\\Temp\\*",
                           "?:\\Users\\*\\AppData\\Roaming\\*",
                           "?:\\Users\\*\\Pictures\\*",
                           "?:\\Users\\*\\Documents\\*",
                           "?:\\Windows\\Resources\\Themes\\*",
                           "?:\\ProgramData\\*") and not process.executable : "?:\\ProgramData\\*\\*") or
    (process.name : ("rundll32.exe", "regsvr32.exe", "WScript.exe")) or
    descendant of [process where event.action == "start" and process.name : "msiexec.exe"]
    )] by process.entity_id
  [process where event.action == "start" and
   process.name : ("cmd.exe", "powershell.exe") and
   process.command_line : ("*Add-MpPreference*", "*Set-MpPreference*") and
   process.command_line: ("*-ExclusionPath*", "*-DisableRealtimeMonitoring*", "*-DisableScriptScanning*", "*-DisableArchiveScanning*")] by process.parent.entity_id