Microsoft Defender Antivirus exclusions on this PC

#Requires -RunAsAdministrator
#Requires -Modules Defender
# Microsoft Defender Antivirus exclusions configured on this device. Read-only.

$preferences = Get-MpPreference

$lists = [ordered]@{
    'Path'       = $preferences.ExclusionPath
    'Process'    = $preferences.ExclusionProcess
    'Extension'  = $preferences.ExclusionExtension
    'IP address' = $preferences.ExclusionIpAddress
}

$exclusions = @(foreach ($type in $lists.Keys) {
    foreach ($value in $lists[$type]) {
        if ($value) { [pscustomobject]@{ Type = $type; Value = $value } }
    }
})

if ($exclusions.Count -eq 0) {
    Write-Output 'No Microsoft Defender Antivirus exclusions are configured.'
}
$exclusions

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check, in an elevated Windows PowerShell 5.1 session.

Reading the output

• Reads the ExclusionPath, ExclusionProcess, ExclusionExtension and ExclusionIpAddress preferences with Get-MpPreference. Per the Set-MpPreference reference, paths and extensions are excluded from scheduled and real-time scanning, and a process exclusion excludes the files that process opens (not the process itself).
• Every exclusion is a place malware can sit unscanned, so each one should have a known owner and reason. A folder exclusion covers everything under it.
• Prints a line saying so when there are no exclusions.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.