Skip to content
Threat Feed
Subscribe

Tag

Exclusion

3 briefs RSS
high advisory

Windows Defender Exclusion Registry Modification

Adversaries modify Windows Defender exclusion registry entries to bypass antivirus and execute malicious code undetected, potentially leading to persistence and further malicious activities.

Windows Defender +3 windows endpoint registry defender exclusion defense-evasion malware
2r 1t
high advisory

Windows Defender Exclusion Added or Modified via Command Line

Adversaries use Add-MpPreference or Set-MpPreference commands to add exclusions in Windows Defender, allowing malicious code to execute undetected, and this activity can be detected via Endpoint Detection and Response (EDR) agents.

Windows Defender +3 windowsdefender exclusion defense-evasion endpoint
2r
high advisory

PowerShell Windows Defender Exclusion Commands

Attackers use PowerShell commands with `Add-MpPreference` or `Set-MpPreference` to create Windows Defender exclusions, allowing malware to execute undetected.

Windows Defender powershell windows-defender exclusion defense-evasion
2r 1t