PowerShell adding exclusion path for Microsoft Defender of ProgramData.yaml

id: bd6e909c-dfb1-4f8f-a94a-14d417bbe87b
name: PowerShell adding exclusion path for Microsoft Defender of ProgramData
description: |
  Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense Evasion
query: |   
  DeviceProcessEvents 
  | where FileName =~ "powershell.exe" and ProcessCommandLine has_all("try", "Add-MpPreference", "-ExclusionPath", "ProgramData", "catch")