CmdID

CmdID / PowerShell / Cmdlets / Add

Add-MpPreference

Modifies settings for Windows Defender. Windows Server PowerShell reference

From the Windows Server PowerShell reference 15 parameters 5 Sigma rules look for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

15 in the Windows Server PowerShell reference
-AsJobRuns the cmdlet as a background job.
-AttackSurfaceReductionOnlyExclusionsSpecifies the files and paths to exclude from attack surface reduction (ASR) rules.
-AttackSurfaceReductionRules_ActionsSpecifies the states of attack surface reduction rules specified by using the AttackSurfaceReductionRules_Ids parameter.
-AttackSurfaceReductionRules_IdsSpecifies the IDs of attack surface reduction rules.
-CimSession, -SessionRuns the cmdlet in a remote session or on a remote computer.
-ControlledFolderAccessAllowedApplicationsSpecifies applications that can make changes in controlled folders.
-ControlledFolderAccessProtectedFoldersSpecifies more folders to protect.
-ExclusionExtensionSpecifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning.
-ExclusionIpAddressSpecifies an array of IP addresses to exclude from scheduled and real-time scanning.
-ExclusionPathSpecifies an array of file paths to exclude from scheduled and real-time scanning.
-ExclusionProcessSpecifies an array of processes, as paths to process images.
-ForceForces the command to run without asking for user confirmation.
-ThreatIDDefaultAction_Actions, -tiddefacaSpecifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter.
-ThreatIDDefaultAction_Ids, -tiddefaciSpecifies an array of threat IDs.
-ThrottleLimitSpecifies the maximum number of concurrent operations that can be established to run the cmdlet.

What looks for it

Sigma process creation rules that name Add-MpPreference
criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
highPowershell Base64 Encoded MpPreference CmdletFlorian Roth (Nextron Systems)
highPowershell Defender Disable Scan FeatureFlorian Roth (Nextron Systems)
mediumPowershell Defender ExclusionFlorian Roth (Nextron Systems)