Enumerate Antivirus Configuration

Adversaries and authorized testers may inspect the local configuration of antivirus and endpoint-protection software to determine what is enabled and which paths or processes are excluded, so that later actions can be planned around it. This entity is scoped to a read-only audit of Microsoft Defender protection status, preferences, and exclusions on a Windows endpoint; it does not provide commands to disable protection or bypass tamper protection. It reports Microsoft Defender state only and is not an inventory of third-party antivirus products or a complete view of the endpoint's security controls.