(CommandLine:Add\-MpPreference\ * OR CommandLine:Set\-MpPreference\ *) (CommandLine:\ \-ExclusionPath\ * OR CommandLine:\ \-ExclusionExtension\ * OR CommandLine:\ \-ExclusionProcess\ * OR CommandLine:\ \-ExclusionIpAddress\ *)