Windows Defender Exclusions via WMI

api where
  process.Ext.api.name == "IWbemServices::ExecMethod" and
  process.Ext.api.parameters.operation : "*MSFT_MpPreference::Add*" and

  not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\Sys?????\\WindowsPowerShell\\v*\\powershell.exe") and
  not (process.executable == "C:\\Windows\\System32\\svchost.exe" and process.parent.executable == "C:\\Windows\\System32\\services.exe") and
  not process.parent.executable : (
          "?:\\Program Files\\JetBrains\\*\\lib\\ReSharperHost\\JetBrains.Rider.AfterInstall.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\*\\lib\\ReSharperHost\\JetBrains.Rider.AfterInstall.exe", 
          "?:\\Program Files\\JetBrains\\*\\bin\\elevator.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\*\\bin\\elevator.exe", 
          "?:\\Users\\*\\AppData\\Local\\Temp\\dbeaver-ce-*", 
          "?:\\Users\\*\\AppData\\Local\\Temp\\*\\dbeaver-ce-*", 
          "?:\\Users\\*\\Downloads\\dbeaver-ce-*", 
          "?:\\Users\\*\\Downloads\\dbeaver-ee-*", 
          "?:\\ProgramData\\chocolatey\\lib\\dbeaver\\tools\\dbeaver-ce-*", 
          "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\DCHUService.exe"
        ) and
  not (process.code_signature.subject_name in ("Censornet Limited") and process.code_signature.trusted == true) and
  not (process.executable : "?:\\Program Files\\AppsAnywhere\\AppsAnywhere\\AppsAnywhereUpdaterService.exe" and
       process.parent.executable : "?:\\Windows\\System32\\services.exe" and user.id == "S-1-5-18" and
       process.code_signature.subject_name in ("AppsAnywhere Limited", "AppsAnywhere Ltd") and
       process.code_signature.trusted == true) and
  not (process.executable : "?:\\Program Files\\HarfangLab\\hurukai.exe" and
       process.parent.executable : "?:\\Windows\\System32\\services.exe" and user.id == "S-1-5-18" and
       process.Ext.protection == "PsProtectedSignerAntimalware-Light" and
       process.code_signature.subject_name == "HarfangLab SAS" and process.code_signature.trusted == true) and
  not (process.parent.executable : "C:\\Windows\\SysWOW64\\cmd.exe" and process.name : "powershell.exe" and
       process.command_line : "powerShell  Add-MpPreference -ControlledFolderAccessAllowedApplications*") and
  not (process.name : "wmic.exe" and
       process.command_line : ("WMIC  /NAMESPACE:\\\\root\\Microsoft\\Windows\\Defender PATH MSFT_MpPreference call Add ExclusionPath=\"c:\\windows\\puppet\\activate\\*",
                               "WMIC  /NAMESPACE:\\\\root\\Microsoft\\Windows\\Defender PATH MSFT_MpPreference call Add ExclusionPath=\"C:\\Windows\\AAct_Tools\\*")) and
  not process.command_line : "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess \"UltraSearch.exe\" " and
  not (process.name : "powershell.exe" and
       process.command_line : ("*JABlAHgAYwBsAHUAcwBpAG8AbgBzAD0AQAAoACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEQAQgBlAGEAdgBlAHIAXABkAGIAZQBhAHYAZQByAC4AZQB4AGUAI*",
                               "*AkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwA*",
                               "*WwBDAG8AbABsAGUAYwB0AGkAbwBuAHMALgBHAGUAbgBlAHIAaQBjAC4ASABhAHMAaABTAGUAdABbAFMAdAByAGkAbgBnAF0AXQAoAEcAZQB0AC0A*")) and
  not (process.parent.executable : "C:\\Windows\\System32\\cmd.exe" and process.command_line : "*\\EC2Launch*\\UserScript.ps1*")