🎯 Windows Defender exclusion abuse

The items that name it 2

• UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  writeup2026-08-20

  Modifying Registry and using PowerShell (Add-MpPreference -ExclusionPath) to add IIS directories to Windows Defender exclusion list, hiding malware from AV scans

• N-IOCs to Rule Them All
  writeup2023-12-31It is written here as Windows Defender exclusion abuse (IOC #1).

  Malware creates a Defender scan exclusion for a directory/file to avoid detection, recorded as event ID 5007