//CW - Defender Exclusion Path Hunt (defense evasion)
DeviceEvents
| where DeviceName startswith "naming.convention"
| where ActionType == "PowerShellCommand"
| extend Command = tostring(parse_json(AdditionalFields).["Command"])
| where Command contains "Add-MpPreference"