Defender exclusion

Add-MpPreference -ExclusionPath C:\Users\Public

Adds a path to Microsoft Defender exclusions so it won't scan or block your tools in that folder.

Run it when you have local admin and want to operate from a folder (C:\Users\Public, C:\Windows\Temp) without Defender deleting the payload or loader. It's the most common evasion in ransomware and low-budget red teaming: one cmdlet and done.

Any third-tier EDR (CrowdStrike, SentinelOne, Defender for Endpoint in block mode) ignores local exclusions or reports them as tampering. If Defender is managed via GPO/Intune, the change reverts on the next policy refresh.