Potential Windows Defender Tampering Via Wmic.EXE
Detects potential tampering with Windows Defender settings, such as adding exclusions, using the wmic.exe utility. This activity can be indicative of an adversary attempting to impair defenses to avoid detection.
Sigma
