An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the…

The PowerShell command Add-MpPreference -ExclusionPath is used to configure Windows Defender Antivirus settings. Specifically, it adds the specified file path (%Program Filest\ksysconfig) to the antivirus exclusion list. By doing this, the malware prevents its files from being scanned and detected by the local security software. This action is a clear example of defense evasion, a tactic used by adversaries to avoid detection by security controls. The high volume of DNS queries is the malicious activity that this evasion technique is intended to protect.

A. Persistence: This command does not make the malware run automatically after a reboot; it only hides the malware from the antivirus, which is not a persistence mechanism.

B. Privilege escalation: This command requires administrative privileges to execute; it does not grant them. The privilege escalation would have had to occur prior to this command being run.

C. Credential harvesting: The command's function is to modify antivirus settings, not to steal user credentials like passwords or tokens.

1. MITRE ATT&CK® Framework. (2023). Impair Defenses: Disable or Modify Tools

T1562.001. The MITRE Corporation. Retrieved from https://attack.mitre.org/techniques/T1562/001/.

This official source documents the adversary technique of modifying security tools. It explicitly states

"Adversaries may disable or modify defensive tools to avoid detection... This can include... adding exclusions to a tool’s inclusion/exclusion list." This directly maps the command in the question to the Defense Evasion tactic.

2. Microsoft Corporation. (2023). Add-MpPreference - Microsoft PowerShell Documentation. Retrieved from https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference.

The official vendor documentation for the Add-MpPreference cmdlet confirms its purpose is to "modify preferences for Windows Defender." The -ExclusionPath parameter is documented as the method for excluding a path from scheduled and real-time scanning

confirming its use as a defense evasion mechanism.

3. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press.

In Chapter 1

"Basic Analysis

" the text discusses common malware characteristics. Under "Malware Evasion and Persistence

" it describes how malware often attempts to disable or bypass security software

including antivirus products

as a primary goal to remain undetected. Adding an AV exclusion is a specific implementation of this broader

well-documented technique. (This is a highly respected academic-level textbook used in university curricula).