├── .gitignore ├── App.config ├── LICENSE ├── Program.cs ├── README.md ├── SharpExclusionFinder.csproj └── SharpExclusionFinder.sln /.gitignore: -------------------------------------------------------------------------------- 1 | __pycache__ 2 | .venv 3 | ## Ignore Visual Studio temporary files, build results, and 4 | ## files generated by popular Visual Studio add-ons. 5 | ## 6 | ## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore 7 | 8 | venv 9 | 10 | # User-specific files 11 | *.rsuser 12 | *.suo 13 | *.user 14 | *.userosscache 15 | *.sln.docstates 16 | 17 | # User-specific files (MonoDevelop/Xamarin Studio) 18 | *.userprefs 19 | 20 | # Mono auto generated files 21 | mono_crash.* 22 | 23 | # Build results 24 | [Dd]ebug/ 25 | [Dd]ebugPublic/ 26 | [Rr]elease/ 27 | [Rr]eleases/ 28 | x64/ 29 | x86/ 30 | [Ww][Ii][Nn]32/ 31 | [Aa][Rr][Mm]/ 32 | [Aa][Rr][Mm]64/ 33 | bld/ 34 | [Bb]in/ 35 | [Oo]bj/ 36 | [Ll]og/ 37 | [Ll]ogs/ 38 | 39 | # Visual Studio 2015/2017 cache/options directory 40 | .vs/ 41 | # Uncomment if you have tasks that create the project's static files in wwwroot 42 | #wwwroot/ 43 | 44 | # Visual Studio 2017 auto generated files 45 | Generated\ Files/ 46 | 47 | # MSTest test Results 48 | [Tt]est[Rr]esult*/ 49 | [Bb]uild[Ll]og.* 50 | 51 | # NUnit 52 | *.VisualState.xml 53 | TestResult.xml 54 | nunit-*.xml 55 | 56 | # Build Results of an ATL Project 57 | [Dd]ebugPS/ 58 | [Rr]eleasePS/ 59 | dlldata.c 60 | 61 | # Benchmark Results 62 | BenchmarkDotNet.Artifacts/ 63 | 64 | # .NET Core 65 | project.lock.json 66 | project.fragment.lock.json 67 | artifacts/ 68 | 69 | # ASP.NET Scaffolding 70 | ScaffoldingReadMe.txt 71 | 72 | # StyleCop 73 | StyleCopReport.xml 74 | 75 | # Files built by Visual Studio 76 | *_i.c 77 | *_p.c 78 | *_h.h 79 | *.ilk 80 | *.meta 81 | *.obj 82 | *.iobj 83 | *.pch 84 | *.pdb 85 | *.ipdb 86 | *.pgc 87 | *.pgd 88 | *.rsp 89 | *.sbr 90 | *.tlb 91 | *.tli 92 | *.tlh 93 | *.tmp 94 | *.tmp_proj 95 | *_wpftmp.csproj 96 | *.log 97 | *.tlog 98 | *.vspscc 99 | *.vssscc 100 | .builds 101 | *.pidb 102 | *.svclog 103 | *.scc 104 | 105 | # Chutzpah Test files 106 | _Chutzpah* 107 | 108 | # Visual C++ cache files 109 | ipch/ 110 | *.aps 111 | *.ncb 112 | *.opendb 113 | *.opensdf 114 | *.sdf 115 | *.cachefile 116 | *.VC.db 117 | *.VC.VC.opendb 118 | 119 | # Visual Studio profiler 120 | *.psess 121 | *.vsp 122 | *.vspx 123 | *.sap 124 | 125 | # Visual Studio Trace Files 126 | *.e2e 127 | 128 | # TFS 2012 Local Workspace 129 | $tf/ 130 | 131 | # Guidance Automation Toolkit 132 | *.gpState 133 | 134 | # ReSharper is a .NET coding add-in 135 | _ReSharper*/ 136 | *.[Rr]e[Ss]harper 137 | *.DotSettings.user 138 | 139 | # TeamCity is a build add-in 140 | _TeamCity* 141 | 142 | # DotCover is a Code Coverage Tool 143 | *.dotCover 144 | 145 | # AxoCover is a Code Coverage Tool 146 | .axoCover/* 147 | !.axoCover/settings.json 148 | 149 | # Coverlet is a free, cross platform Code Coverage Tool 150 | coverage*.json 151 | coverage*.xml 152 | coverage*.info 153 | 154 | # Visual Studio code coverage results 155 | *.coverage 156 | *.coveragexml 157 | 158 | # NCrunch 159 | _NCrunch_* 160 | .*crunch*.local.xml 161 | nCrunchTemp_* 162 | 163 | # MightyMoose 164 | *.mm.* 165 | AutoTest.Net/ 166 | 167 | # Web workbench (sass) 168 | .sass-cache/ 169 | 170 | # Installshield output folder 171 | [Ee]xpress/ 172 | 173 | # DocProject is a documentation generator add-in 174 | DocProject/buildhelp/ 175 | DocProject/Help/*.HxT 176 | DocProject/Help/*.HxC 177 | DocProject/Help/*.hhc 178 | DocProject/Help/*.hhk 179 | DocProject/Help/*.hhp 180 | DocProject/Help/Html2 181 | DocProject/Help/html 182 | 183 | # Click-Once directory 184 | publish/ 185 | 186 | # Publish Web Output 187 | *.[Pp]ublish.xml 188 | *.azurePubxml 189 | # Note: Comment the next line if you want to checkin your web deploy settings, 190 | # but database connection strings (with potential passwords) will be unencrypted 191 | *.pubxml 192 | *.publishproj 193 | 194 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 195 | # checkin your Azure Web App publish settings, but sensitive information contained 196 | # in these scripts will be unencrypted 197 | PublishScripts/ 198 | 199 | # NuGet Packages 200 | *.nupkg 201 | # NuGet Symbol Packages 202 | *.snupkg 203 | # The packages folder can be ignored because of Package Restore 204 | **/[Pp]ackages/* 205 | # except build/, which is used as an MSBuild target. 206 | !**/[Pp]ackages/build/ 207 | # Uncomment if necessary however generally it will be regenerated when needed 208 | #!**/[Pp]ackages/repositories.config 209 | # NuGet v3's project.json files produces more ignorable files 210 | *.nuget.props 211 | *.nuget.targets 212 | 213 | # Microsoft Azure Build Output 214 | csx/ 215 | *.build.csdef 216 | 217 | # Microsoft Azure Emulator 218 | ecf/ 219 | rcf/ 220 | 221 | # Windows Store app package directories and files 222 | AppPackages/ 223 | BundleArtifacts/ 224 | Package.StoreAssociation.xml 225 | _pkginfo.txt 226 | *.appx 227 | *.appxbundle 228 | *.appxupload 229 | 230 | # Visual Studio cache files 231 | # files ending in .cache can be ignored 232 | *.[Cc]ache 233 | # but keep track of directories ending in .cache 234 | !?*.[Cc]ache/ 235 | 236 | # Others 237 | ClientBin/ 238 | ~$* 239 | *~ 240 | *.dbmdl 241 | *.dbproj.schemaview 242 | *.jfm 243 | *.pfx 244 | *.publishsettings 245 | orleans.codegen.cs 246 | 247 | # Including strong name files can present a security risk 248 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 249 | #*.snk 250 | 251 | # Since there are multiple workflows, uncomment next line to ignore bower_components 252 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 253 | #bower_components/ 254 | 255 | # RIA/Silverlight projects 256 | Generated_Code/ 257 | 258 | # Backup & report files from converting an old project file 259 | # to a newer Visual Studio version. Backup files are not needed, 260 | # because we have git ;-) 261 | _UpgradeReport_Files/ 262 | Backup*/ 263 | UpgradeLog*.XML 264 | UpgradeLog*.htm 265 | ServiceFabricBackup/ 266 | *.rptproj.bak 267 | 268 | # SQL Server files 269 | *.mdf 270 | *.ldf 271 | *.ndf 272 | 273 | # Business Intelligence projects 274 | *.rdl.data 275 | *.bim.layout 276 | *.bim_*.settings 277 | *.rptproj.rsuser 278 | *- [Bb]ackup.rdl 279 | *- [Bb]ackup ([0-9]).rdl 280 | *- [Bb]ackup ([0-9][0-9]).rdl 281 | 282 | # Microsoft Fakes 283 | FakesAssemblies/ 284 | 285 | # GhostDoc plugin setting file 286 | *.GhostDoc.xml 287 | 288 | # Node.js Tools for Visual Studio 289 | .ntvs_analysis.dat 290 | node_modules/ 291 | 292 | # Visual Studio 6 build log 293 | *.plg 294 | 295 | # Visual Studio 6 workspace options file 296 | *.opt 297 | 298 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 299 | *.vbw 300 | 301 | # Visual Studio 6 auto-generated project file (contains which files were open etc.) 302 | *.vbp 303 | 304 | # Visual Studio 6 workspace and project file (working project files containing files to include in project) 305 | *.dsw 306 | *.dsp 307 | 308 | # Visual Studio 6 technical files 309 | *.ncb 310 | *.aps 311 | 312 | # Visual Studio LightSwitch build output 313 | **/*.HTMLClient/GeneratedArtifacts 314 | **/*.DesktopClient/GeneratedArtifacts 315 | **/*.DesktopClient/ModelManifest.xml 316 | **/*.Server/GeneratedArtifacts 317 | **/*.Server/ModelManifest.xml 318 | _Pvt_Extensions 319 | 320 | # Paket dependency manager 321 | .paket/paket.exe 322 | paket-files/ 323 | 324 | # FAKE - F# Make 325 | .fake/ 326 | 327 | # CodeRush personal settings 328 | .cr/personal 329 | 330 | # Python Tools for Visual Studio (PTVS) 331 | __pycache__/ 332 | *.pyc 333 | 334 | # Cake - Uncomment if you are using it 335 | # tools/** 336 | # !tools/packages.config 337 | 338 | # Tabs Studio 339 | *.tss 340 | 341 | # Telerik's JustMock configuration file 342 | *.jmconfig 343 | 344 | # BizTalk build output 345 | *.btp.cs 346 | *.btm.cs 347 | *.odx.cs 348 | *.xsd.cs 349 | 350 | # OpenCover UI analysis results 351 | OpenCover/ 352 | 353 | # Azure Stream Analytics local run output 354 | ASALocalRun/ 355 | 356 | # MSBuild Binary and Structured Log 357 | *.binlog 358 | 359 | # NVidia Nsight GPU debugger configuration file 360 | *.nvuser 361 | 362 | # MFractors (Xamarin productivity tool) working folder 363 | .mfractor/ 364 | 365 | # Local History for Visual Studio 366 | .localhistory/ 367 | 368 | # Visual Studio History (VSHistory) files 369 | .vshistory/ 370 | 371 | # BeatPulse healthcheck temp database 372 | healthchecksdb 373 | 374 | # Backup folder for Package Reference Convert tool in Visual Studio 2017 375 | MigrationBackup/ 376 | 377 | # Ionide (cross platform F# VS Code tools) working folder 378 | .ionide/ 379 | 380 | # Fody - auto-generated XML schema 381 | FodyWeavers.xsd 382 | 383 | # VS Code files for those working on multiple tools 384 | .vscode/* 385 | !.vscode/settings.json 386 | !.vscode/tasks.json 387 | !.vscode/launch.json 388 | !.vscode/extensions.json 389 | *.code-workspace 390 | 391 | # Local History for Visual Studio Code 392 | .history/ 393 | 394 | # Windows Installer files from build outputs 395 | *.cab 396 | *.msi 397 | *.msix 398 | *.msm 399 | *.msp 400 | 401 | # JetBrains Rider 402 | *.sln.iml -------------------------------------------------------------------------------- /App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 Friends & Security 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.IO; 5 | using System.Threading; 6 | using System.Threading.Tasks; 7 | 8 | class Program 9 | { 10 | static HashSet excludedDirectories = new HashSet(StringComparer.OrdinalIgnoreCase); 11 | 12 | // Counter for progress 13 | static int counter = 0; 14 | 15 | static int totalDirectories = 0; 16 | 17 | static int maxThreads = 3; 18 | 19 | static int maxDepth = int.MaxValue; // By default, scan all depths 20 | 21 | // Stopwatch to measure performance 22 | static Stopwatch stopwatch = new Stopwatch(); 23 | 24 | static string outputFile = null; 25 | 26 | static StreamWriter logWriter = null; 27 | 28 | static readonly object logWriterLock = new object(); 29 | 30 | static void Main(string[] args) 31 | { 32 | if (args.Length == 0 || args[0] == "-h" || args[0] == "--help") 33 | { 34 | PrintHelp(); 35 | return; 36 | } 37 | 38 | string basePath = args[0]; 39 | 40 | for (int i = 1; i < args.Length; i++) 41 | { 42 | if (args[i] == "--max-threads" && i + 1 < args.Length) 43 | { 44 | if (int.TryParse(args[i + 1], out int threads)) 45 | { 46 | maxThreads = threads; 47 | i++; 48 | } 49 | } 50 | else if (args[i] == "--depth" && i + 1 < args.Length) 51 | { 52 | if (int.TryParse(args[i + 1], out int depth)) 53 | { 54 | maxDepth = depth; 55 | i++; 56 | } 57 | } 58 | else if (args[i] == "--output" && i + 1 < args.Length) 59 | { 60 | outputFile = args[i + 1]; 61 | i++; 62 | } 63 | } 64 | 65 | if (outputFile != null) 66 | { 67 | try 68 | { 69 | logWriter = new StreamWriter(outputFile); 70 | } 71 | catch (Exception ex) 72 | { 73 | Console.WriteLine($"Error opening output file {outputFile}: {ex.Message}"); 74 | return; 75 | } 76 | } 77 | 78 | stopwatch.Start(); 79 | 80 | GetExcludedFoldersByTier(basePath, 0); 81 | 82 | if (logWriter != null) 83 | { 84 | logWriter.Close(); 85 | } 86 | } 87 | 88 | static void PrintHelp() 89 | { 90 | Console.WriteLine("Usage: SharpExclusionFinder.exe [options]"); 91 | Console.WriteLine("Authors: Hoshea Yarden, Hai Vaknin, Yehuda Smirnov, Noam Pomerantz"); 92 | Console.WriteLine("Options:"); 93 | Console.WriteLine(" --max-threads N Set the maximum number of threads (default 3)"); 94 | Console.WriteLine(" --depth N Set the maximum directory depth to scan (1 = immediate subdirectories)"); 95 | Console.WriteLine(" --output Specify a file to log exclusions and errors"); 96 | Console.WriteLine(" -h, --help Display help and usage information"); 97 | } 98 | 99 | // Function to get excluded folders using a tiered approach, with depth limitation 100 | static void GetExcludedFoldersByTier(string basePath, int currentDepth) 101 | { 102 | if (currentDepth > maxDepth) 103 | return; 104 | 105 | var directoriesByTier = new Queue>(); 106 | List currentTierDirectories = new List(); 107 | 108 | try 109 | { 110 | // First, add the top-level directories (first tier) 111 | currentTierDirectories.AddRange(Directory.GetDirectories(basePath)); 112 | directoriesByTier.Enqueue(currentTierDirectories); 113 | } 114 | catch (Exception ex) 115 | { 116 | LogMessage($"Error retrieving top-level directories from {basePath}: {ex.Message}", isError: true); 117 | } 118 | 119 | // Process each tier until all directories are scanned or max depth is reached 120 | while (directoriesByTier.Count > 0 && currentDepth <= maxDepth) 121 | { 122 | var currentTier = directoriesByTier.Dequeue(); 123 | 124 | totalDirectories += currentTier.Count; 125 | 126 | // Filter out excluded directories before processing 127 | List filteredDirectories = new List(); 128 | foreach (var dir in currentTier) 129 | { 130 | if (!IsDirectoryExcluded(dir)) 131 | { 132 | filteredDirectories.Add(dir); 133 | } 134 | } 135 | 136 | ProcessTierDirectories(filteredDirectories); 137 | 138 | List nextTierDirectories = new List(); 139 | 140 | foreach (string dir in filteredDirectories) 141 | { 142 | try 143 | { 144 | var subDirs = Directory.GetDirectories(dir); 145 | nextTierDirectories.AddRange(subDirs); 146 | } 147 | catch (UnauthorizedAccessException) 148 | { 149 | LogMessage($"Access denied to {dir}. Skipping this directory and its subdirectories.", isError: true); 150 | } 151 | catch (Exception ex) 152 | { 153 | LogMessage($"Error retrieving subdirectories from {dir}: {ex.Message}", isError: true); 154 | } 155 | } 156 | 157 | if (nextTierDirectories.Count > 0) 158 | { 159 | directoriesByTier.Enqueue(nextTierDirectories); 160 | } 161 | 162 | currentDepth++; 163 | } 164 | 165 | // Final message 166 | if (currentDepth <= maxDepth) 167 | { 168 | stopwatch.Stop(); 169 | Console.WriteLine($"Scan completed up to depth {maxDepth}. Total time: {stopwatch.Elapsed.TotalSeconds:F2} seconds."); 170 | } 171 | } 172 | 173 | static void ProcessTierDirectories(List directories) 174 | { 175 | SemaphoreSlim semaphore = new SemaphoreSlim(maxThreads); 176 | 177 | List tasks = new List(); 178 | 179 | foreach (string dir in directories) 180 | { 181 | semaphore.Wait(); 182 | 183 | Task task = Task.Run(() => 184 | { 185 | try 186 | { 187 | ScanDirectory(dir); 188 | } 189 | finally 190 | { 191 | semaphore.Release(); 192 | } 193 | }); 194 | 195 | tasks.Add(task); 196 | } 197 | 198 | Task.WaitAll(tasks.ToArray()); 199 | } 200 | 201 | // Function to scan each directory 202 | static void ScanDirectory(string currentPath) 203 | { 204 | try 205 | { 206 | int currentCount = Interlocked.Increment(ref counter); 207 | 208 | // Print every 500 directories processed 209 | if (currentCount % 500 == 0) 210 | { 211 | TimeSpan elapsed = stopwatch.Elapsed; 212 | Console.WriteLine($"Processed {currentCount} directories. Time elapsed: {elapsed.TotalSeconds:F2} seconds."); 213 | } 214 | 215 | // Run the Windows Defender scan command on the current directory 216 | string command = $@"C:\Program Files\Windows Defender\MpCmdRun.exe"; 217 | string args = $"-Scan -ScanType 3 -File \"{currentPath}\\|*\""; 218 | 219 | string output = RunProcess(command, args); 220 | 221 | if (output.Contains("was skipped")) 222 | { 223 | LogMessage($"[+] Folder {currentPath} is excluded", isError: false); 224 | excludedDirectories.Add(currentPath); // Add the directory to the exclusion list 225 | } 226 | } 227 | catch (UnauthorizedAccessException) 228 | { 229 | LogMessage($"Skipping {currentPath} due to UnauthorizedAccessException.", isError: true); 230 | } 231 | catch (Exception ex) 232 | { 233 | LogMessage($"An error occurred while scanning directory {currentPath}: {ex.Message}", isError: true); 234 | } 235 | } 236 | 237 | // Function to check if a directory or its parent is excluded 238 | static bool IsDirectoryExcluded(string directory) 239 | { 240 | string currentDirectory = directory; 241 | while (!string.IsNullOrEmpty(currentDirectory)) 242 | { 243 | if (excludedDirectories.Contains(currentDirectory)) 244 | { 245 | return true; 246 | } 247 | currentDirectory = Path.GetDirectoryName(currentDirectory); 248 | } 249 | return false; 250 | } 251 | 252 | // Function to run a process and return the output 253 | static string RunProcess(string command, string arguments) 254 | { 255 | try 256 | { 257 | ProcessStartInfo processInfo = new ProcessStartInfo(command, arguments) 258 | { 259 | RedirectStandardOutput = true, 260 | UseShellExecute = false, 261 | CreateNoWindow = true 262 | }; 263 | 264 | using (Process process = Process.Start(processInfo)) 265 | { 266 | using (StreamReader reader = process.StandardOutput) 267 | { 268 | string result = reader.ReadToEnd(); 269 | return result; 270 | } 271 | } 272 | } 273 | catch (Exception ex) 274 | { 275 | LogMessage($"Error running process: {ex.Message}", isError: true); 276 | return string.Empty; 277 | } 278 | } 279 | 280 | // Function to log messages either to console or output file 281 | static void LogMessage(string message, bool isError) 282 | { 283 | if (logWriter != null && (isError || message.Contains("[+] Folder"))) 284 | { 285 | lock (logWriterLock) 286 | { 287 | logWriter.WriteLine(message); 288 | logWriter.Flush(); 289 | } 290 | } 291 | 292 | Console.WriteLine(message); 293 | } 294 | } 295 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SharpExclusionFinder 2 | 3 | ## Overview 4 | 5 | This C# program finds Windows Defender folder exclusions using **Windows Defender** through its command-line tool (`MpCmdRun.exe`). The program processes directories recursively, with configurable depth and thread usage, and outputs information about exclusions and scan progress. 6 | 7 | The program allows you to: 8 | - Scan for folder exclusions up to a specified depth, **without relying on event logs or admin permissions**. 9 | - Use multi-threading to speed the scan process. 10 | - Log errors and exclusion messages to a specified output file. 11 | 12 | ## Usage 13 | 14 | ### Basic Command: 15 | ```powershell 16 | program.exe [options] 17 | ``` 18 | 19 | ### Options: 20 | - `--max-threads N`: Set the maximum number of threads to use for scanning. Default is 3. 21 | - `--depth N`: Specify the maximum directory depth to scan. Depth 1 means only immediate subdirectories. 22 | - `--output `: Specify a file path to log exclusions and errors. 23 | - `-h`, `--help`: Display help and usage information. 24 | 25 | ### Example: 26 | ```powershell 27 | program.exe "C:\MyDirectory" --max-threads 5 --depth 3 --output scan_log.txt 28 | ``` 29 | This will scan `C:\MyDirectory` up to a depth of 3 subdirectories, using 5 threads, and log any exclusions or errors to `scan_log.txt`. 30 | 31 | ## How It Works 32 | 33 | A blog explaining the technique utilised can be viewed here - https://blog.fndsec.net/2024/10/04/uncovering-exclusion-paths-in-microsoft-defender-a-security-research-insight 34 | 35 | ## Example Output 36 | ``` 37 | Processed 2000 directories. Time elapsed: 23.78 seconds. 38 | [+] Folder C:\users\user\Example is excluded 39 | Processed 2500 directories. Time elapsed: 30.77 seconds. 40 | ``` 41 | 42 | ## Prerequisites 43 | 44 | - **.NET Framework 4.5.2** or later. 45 | - **Windows Defender** must be installed and enabled on the system. 46 | - **MpCmdRun.exe** must be located at `C:\Program Files\Windows Defender\MpCmdRun.exe`. 47 | -------------------------------------------------------------------------------- /SharpExclusionFinder.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {8C3E491F-4318-46EA-9442-814A4891C98E} 8 | Exe 9 | SharpExclusionFinder 10 | SharpExclusionFinder 11 | v4.5.1 12 | 512 13 | true 14 | true 15 | 16 | 17 | AnyCPU 18 | true 19 | full 20 | false 21 | bin\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | AnyCPU 28 | pdbonly 29 | true 30 | bin\Release\ 31 | TRACE 32 | prompt 33 | 4 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | -------------------------------------------------------------------------------- /SharpExclusionFinder.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.11.35208.52 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpExclusionFinder", "SharpExclusionFinder.csproj", "{8C3E491F-4318-46EA-9442-814A4891C98E}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {8C3E491F-4318-46EA-9442-814A4891C98E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {8C3E491F-4318-46EA-9442-814A4891C98E}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {8C3E491F-4318-46EA-9442-814A4891C98E}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {8C3E491F-4318-46EA-9442-814A4891C98E}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {7D3DFBBF-A08F-44F0-852F-DB18472654B3} 24 | EndGlobalSection 25 | EndGlobal 26 | --------------------------------------------------------------------------------