Windows Defender exclusion configured via PowerShell preference cmdlet

Siemphony@siemphonylowT1679unverified

AN2030 offers four log sources — PowerShell script block logging, Security 4688 process creation, and two variants of a file-modification leg (Security 4663 and 4670/4656) — and only the PowerShell leg can carry a genuinely distinguishing signal. `Add-MpPreference` and `Set-MpPreference` are the cmdlets that write Defender's exclusion list, and their `-Exclusion*` parameters are exactly MITRE's `ExclusionTargetList` knob turned into arguments a script would actually pass; this rule matches the cmdlet name together with one of those parameter names in the same script block. Security 4688's `CommandLine` would see the same string only when the cmdlet reaches a new process on a single line — a `-Command` one-liner or a saved script — but an operator who pastes the cmdlet directly at an interactive PowerShell prompt never spawns a new process, so 4688 misses exactly the case a defender would expect script-block logging to catch, and this rule uses 4104 instead. 4104 is off by default — it requires the "Turn on PowerShell Script Block Logging" Group Policy (or the equivalent `HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging` registry key) enabled on the host first; without it this rule sees nothing, which reads as quiet rather than the blind spot it actually is. The two file-modification legs are declined outright: 4663/4670/4656 are the object- access events for the File System object type (see AUTHORING.md's note on 4657 vs 4663), and the change `Add-MpPreference` actually makes lands in the registry, under `HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\`, which is a 4657 event this brief does not offer — so neither file-modification leg can see a registry-based exclusion at all. AN2030's other described behaviour, enumerating file names and critical extensions for exclusion targeting, has no cmdlet-level signature distinct from ordinary file enumeration and is not attempted here. This rule sees only exclusions set through these two cmdlets — direct registry writes via `reg add`, `regedit`, or a `New-Item` under the Exclusions key bypass it entirely, as does any third-party AV or backup product's own exclusion mechanism, since MpPreference is Defender-specific. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0897, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "Add-MpPreference" or ScriptBlockText contains "Set-MpPreference")) and (ScriptBlockText contains "-ExclusionPath" or ScriptBlockText contains "-ExclusionExtension" or ScriptBlockText contains "-ExclusionProcess" or ScriptBlockText contains "-ExclusionIpAddress"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*Add-MpPreference*" OR ScriptBlockText="*Set-MpPreference*")) AND (ScriptBlockText="*-ExclusionPath*" OR ScriptBlockText="*-ExclusionExtension*" OR ScriptBlockText="*-ExclusionProcess*" OR ScriptBlockText="*-ExclusionIpAddress*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*add-mppreference*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*set-mppreference*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*-exclusionpath*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-exclusionextension*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-exclusionprocess*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-exclusionipaddress*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Add-MpPreference|Set-MpPreference)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(-ExclusionPath|-ExclusionExtension|-ExclusionProcess|-ExclusionIpAddress)</field>    <description>Windows Defender exclusion configured via PowerShell preference cmdlet</description>    <mitre>      <id>T1679</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: defense_evasion_disable_tools
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: fceabd94-93b4-484c-a704-c3e2c0da127b

ATT&CKT1679

T1679Selective Exclusion

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion disable tools

defense evasion disable toolsAI draft — unreviewed

01 · What this rule detects

Someone using Add-MpPreference or Set-MpPreference from PowerShell to add an exclusion to Windows Defender's scan scope — a path, extension, or process Defender will stop inspecting. MITRE's AN2030 frames this as an attacker widening the space they can operate in undetected: once an exclusion exists, payloads staged there or tools launched from there never reach Defender's engine.

02 · Telemetry you need

PowerShell Script Block Logging (EventID 4104) on Microsoft-Windows-PowerShell/Operational. This is off by default — it needs the "Turn on PowerShell Script Block Logging" Group Policy, or the equivalent HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging registry key, enabled first. Without it the rule isn't quiet, it's blind: zero matches means nobody looked, not that nobody excluded anything.

03 · How the logic works

Three selections, all ANDed. selection_event pins EventID 4104. selection_cmdlet requires ScriptBlockText to contain Add-MpPreference or Set-MpPreference. selection_exclusion requires one of four -Exclusion* parameter names — Path, Extension, Process, IpAddress — in the same script block. The parameter names trace to MITRE's ExclusionTargetList knob turned into literal arguments a script would actually pass; the specific four-item list is the pipeline's own enumeration of that knob, not MITRE's. The rule skips Security 4688 (misses an interactive one-liner typed at a live console, which never spawns a new process) and both file-modification legs the brief offers — 4663/4670/4656 are File System object-access events, but the change these cmdlets actually make lands in the registry under Defender's Exclusions key, a 4657 event this brief doesn't carry, so neither leg can see it.

04 · Common false positives

By a wide margin on any managed fleet, the dominant source is endpoint-management tooling — SCCM/MECM, Intune baselines, GPO startup scripts — pushing an approved exclusion set at provisioning or policy refresh. Backup and line-of-business installers (Veeam, Acronis) call the same cmdlets during their own setup. Admins also run these interactively after a legitimate false-positive detection. None of these carry any marker in the rule as written that would distinguish them from an attacker doing the same thing.

05 · Detection maturity

tier_1: This rule has never been run against a log line. It sits at the lowest DeBMM tier — Initial/Unverified — until it has fired against real 4104 data, its false-positive volume from managed-fleet tooling has been measured against an actual exclusion inventory, and the ExclusionIpAddress scope question has been resolved or deliberately accepted.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Correlate matches against a known-good exclusion inventory or CMDB rather than alerting on every hit — the SCCM/Intune volume alone will bury this in a SOC queue. -ExclusionIpAddress is included for completeness against MITRE's knob even though it targets Network Protection scanning rather than file/folder exclusion, which a reviewer flagged as scope drift against AN2030's stated ransomware/payload-exclusion scenario; dropping it is a reasonable first tuning pass. level: low already reflects that the loudest false positive is the dominant fleet-wide case — treat this as a hunting lead against an inventory, not a standalone alert.

Declared by the author

Endpoint management platforms — SCCM/MECM, Intune baselines, and GPO startup scripts — that push a standard, approved Defender exclusion set to every machine at provisioning or policy-refresh time; on a managed fleet this is the dominant source of matches by a wide margin.
Backup and line-of-business installers, such as Veeam or Acronis agents, that call Add-MpPreference during their own setup to exclude their repository or working directories from real-time scanning.
IT and security administrators deliberately excluding a newly onboarded application's install path after a false-positive detection, run interactively from an elevated console.
Detection-engineering and atomic-test validation runs that execute these cmdlets to demonstrate or self-test the analytic rather than to conceal anything.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1679, evaluated against their — events.

Share this rule

/u/siemphony/fceabd94-93b4-484c-a704-c3e2c0da127b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Windows Defender exclusion configured via PowerShell preference cmdlet

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it