Windows Defender Exclusion of C Drive - PowerShell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to exclude the entire C:\ drive from Microsoft Defender Antivirus scanning. Adversaries may attempt to exclude the entire C:\ drive from Microsoft Defender Antivirus scanning to avoid detection of their malicious activities. The entire C:\ drive, including all its subdirectories (C:\Windows\, C:\Program Files\, C:\Users\, etc.), will not be scanned. This can be used to hide malware from being detected by Microsoft Defender Antivirus.

2025-03-13 00:00:00

None

432aaba7-c02b-4d38-9e22-56623be27cee

attack.defense-evasion attack.t1562.001

Nextron Sigma feed only (private)