Windows Defender Exclusions Added - PowerShell

Title: Windows Defender Exclusions Added - PowerShell
Status: test
Description:Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
References:
  -https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-16
modified:2022-11-26
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'
• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: ps_script
• product: windows
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_args_exc:
    ScriptBlockText|contains:
      -' -ExclusionPath '
      -' -ExclusionExtension '
      -' -ExclusionProcess '
      -' -ExclusionIpAddress '

  selection_args_pref:
    ScriptBlockText|contains:
      -'Add-MpPreference '
      -'Set-MpPreference '

  condition:all of selection*
Falsepositives:
  -Unknown
Level: medium