Defense evasion via Windows Defender exclusions
Named by 2 kept items in this workspace.
Search every workspace for Defense evasion via Windows Defender exclusions. It matches the name as written, so it can find other things that share it.
The items that name it 2
CRUDEEXCLUDE adds specific directory paths to Windows Defender exclusions via PowerShell to prevent detection of HEAVYGRAM components.
PowerShell Add-MpPreference commands used to exclude paths and extensions (.exe, .bin, .dll) from Windows Defender scanning ahead of deploying malware.
All techniques in this workspace.