How to find out particular .exe files is excluded from Virtual machine

Question

We received alert from security team saying PowerShell exe files is excluded , here is the comment from security team

suspicious modification of antivirus exclusion on the virtual machine XXX in the respective subscription.

here is the screenshot of reports from azure portal:

We want to how it got excluded MSmpeng.ex file? from VM?

if I know I can tell that whether it is there or not?

What are all and where to check in VM?

Please suggest

Answer 1

@sns

Thank you for posting your query on Microsoft Q&A, from above description I was able to understand that you got a suspicious exclusion alert from Microsoft defender for cloud. Now you want to know how it got excluded from the scan, validate its location and perform further checks?

Please do correct me if this is not the case by responding in the comments section:

As a first action you must validate locally on the impacted device if the file is added under exclusion manually:

• Check via Get-MpPreference PowerShell to validate the path of the file/process:

Go to Start > Settings > Privacy& Security > Windows Security > Virus & threat protection. Under Virus & threat protection settings, select Manage settings, and then under Exclusions, select Add or remove exclusions to see if file is excluded or not.

• Now navigate to Event Viewer. In the console tree, expand Applications and Services Logs > Microsoft > Windows > Windows Defender. Double-click on Operational to validate when did this change happen:

• Now remove the application path from the file and validate the scan results.
• To understand how the application/file got excluded you need to validate your policies in following portal for exclusion list: MDE portal or Intune.

---

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik