MKDOOR Defender Exclusion via WMI

Kaung Khant Ko@kaungkhantko

•updated Jan 30, 2026•13•1•162

Detects attempts to add file paths to Microsoft Defender's exclusion list using WMIC, a specific defense evasion technique identified in the MKDOOR backdoor associated with PeckBirdy campaigns.