abusing system variables on Defender exclusion

Hello All,

During our internal team exercise the attacker team was able to abuse the use of system variable and compromised the Defender exclusion list to avoid disabling the agent and allowed them to perform their actions undetected. 

They were able to point the variable to another locations to bypass the protection. 

Any suggestions how it can be prevent