Defender exclusion audit

Get-MpPreference | Select ExclusionPath

Review the Defender exclusions on the host, identifying the paths and processes that the antivirus does not scan (possible attacker blind spots).

Run it when you want to know what is excluded from Defender scanning: exclusions (paths, processes, extensions) disable protection over the excluded item — and they are a classic attacker target: adding the payload path to exclusions so the AV doesn't touch it. The exclusion audit answers 'what doesn't Defender scan and why?': each exclusion is either justified (performance, legacy app) or removed. In hardening and IR, reviewing exclusions is one of the first checks: an unjustified exclusion of Temp or a user directory is a compromise finding.

Don't use it as a verdict: legitimate exclusions exist (apps that slow down, performance paths) — the audit documents each one, it doesn't blindly remove them. And beware: Get-MpPreference shows local and policy exclusions; exclusions added by the attacker disappear with the compromised host — real-time detection of exclusion changes is in Defender events (5007) and the EDR. Manual review is the snapshot; monitoring the change is the detection. In environments with another AV, the equivalent audit is of the corresponding product.