Elastic medium stable eql

Windows Defender Exclusions Added via PowerShell

Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
 (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")) and
  process.args : ("*Add-MpPreference*", "*Set-MpPreference*") and
  process.args : ("*-Exclusion*")

Field Validations

Loading…

Comments (0)

Loading comments...