Windows Defender Exclusions by Path

sequence with maxspan=1m
[process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
 not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true) and
 not (process.code_signature.subject_name == "Datto Inc" and process.code_signature.trusted == true)
 ] by process.name
[registry where
 registry.path :
       ("HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\*",
        "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\*")] by registry.value