Powershell to automate Defender Exclusions during build

[warrentc3]

I run this in a separate PowerShell Window during the build process. It automatically excludes the EXE files from on-access scanning in Defender, then removes when build process is done.

$MABSPath = 'C:\mabs'
Import-Module Defender
$DefenderPreferences = Get-MpPreference
if ($MABSPath -in $DefenderPreferences.ExclusionPath ){}else { Add-MpPreference -ExclusionPath $MABSPath }

while( $null -ne ( Get-Process | Where-Object {$_.Path -like "$($MABSPath)*"} ) ){ 
    $DefenderPreferences = Get-MpPreference
    Get-ChildItem -Path ([System.IO.Path]::Combine($MABSPath,'msys64'),[System.IO.Path]::Combine($MABSPath,'build')) -Filter '*.exe' -Recurse:$true | ForEach-Object { $_.Directory.FullName } | Select-Object -Unique | ForEach-Object { 
        $ExePath = [System.IO.Path]::Combine($_,"*.exe"); if ($ExePath -in $DefenderPreferences.ExclusionProcess ){}else{ Add-MpPreference -ExclusionProcess $ExePath }
    }
    Write-Host "Still Going... $((Get-Date).DateTime)";
    Start-Sleep -Seconds 60 
}

$DefenderPreferences = Get-MpPreference
$DefenderPreferences.ExclusionProcess | ForEach-Object { 
    if ( $_.StartsWith($MABSPath)  ) { Remove-MpPreference -ExclusionProcess $_ }
}

[hydra3333]

Hello.

I run MABS builds in a Windows Sandbox and have not encountered an issue with Windows Defender pop-ups, neither in the Sandbox nor when the .exe file(s) are copied to the host.
Hence I am unsure why this would be needed now. Is it a recent problem for everyone ?
Thank you for the code, though.

Pending clarification, may I recommend against implementing such a thing directly into in MABS on the basis that a significant number of "foreign" exes are downloaded and/or built and/or run during the build processes which are largely, and likely completely, unknown to most MABS users (neither MABS nor the user provides them nor guarantees safety of the sources or build files etc) ... and to implement antivirus exclusions automatically would be creating a wonderful attack vector. Disabling security features is, in principle, never ever a good idea; I don't do it for my own home grown utilities built into self-contained .exes and when pop-ups occurred due to that I found alternative non-security-lessening ways.

Perhaps of interest, I and probably/hopefully others operate in non-Admin usernames and suspect that creating Windows Defender exclusions requires Admin privilege.

Just a thought.

Cheers

[L4cache]

I think the main reason of this script is to speed up the building process, by preventing the WD scanning every binary created / executed.
My personal choice is much like hydra3333, run MABS in a VM, mine is a complete VM with WD disabled (by installing other AV...).