Abusing Windows Defender Exclusions

Windows Defender Exclusions

List exclusions from cmd.exe

“Everyone” has read permission for this:

reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s

List exclusions from PowerShell

It may be possible to enumerate file and directory exclusions from a Windows workstation using this cmdlet. Simply execute it in a PowerShell interpreter and observe the output.

Get-MpPreference

Some fields of interest returned are:

ExclusionExtension
ExclusionIpAddress
ExclusionPath
ExclusionProcess

List all excluded paths with:

(Get-MpPreference).ExclusionPath |format-list

Modify Windows Defender Exceptions with PowerShell

Add an excluded file/folder to Windows Defender (PowerShell):

Add-MpPreference -ExclusionPath A:\