Microsoft Defender Exclusion Tampering

Adversaries may impair Microsoft Defender Antivirus scanning by adding exclusions for paths or file types, or by excluding files opened by specified processes. This Windows-specific example covers exclusion-based impairment within T1685; it does not represent all ways to disable or modify security tools. Exclusion changes can also be legitimate and should be assessed against approved policy.