Detection: Powershell Windows Defender Exclusion Commands

Updated Date: 2026-06-29 ID: 907ac95c-4dd9-11ec-ba2c-acde48001122 Author: Teoderick Contreras, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions. It leverages EventCode 4104 to identify suspicious Add-MpPreference or Set-MpPreference commands with exclusion parameters. This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection. If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.

Search

 1`powershell`
 2EventCode=4104
 3ScriptBlockText IN (
 4    "*Add-MpPreference *",
 5    "*Set-MpPreference *"
 6)
 7ScriptBlockText = "*-exclusion*"
 8
 9| fillnull
10
11| stats count min(_time) as firstTime
12              max(_time) as lastTime
13  by dest signature signature_id
14     user_id vendor_product EventID
15     Guid Opcode Name
16     Path ProcessID ScriptBlockId
17     ScriptBlockText
18
19| `security_content_ctime(firstTime)`
20
21| `security_content_ctime(lastTime)`
22
23| `powershell_windows_defender_exclusion_commands_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
powershell_windows_defender_exclusion_commands_filter	`search *`

powershell_windows_defender_exclusion_commands_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1685	Disable or Modify Tools	Defense Impairment

Exploitation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Registry node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.

Known False Positives

admin or user may choose to use this windows features.

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$	dest	system	20
A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$ by user $user_id$	user_id	user	20

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 17