Mkdoor Defender Exclusion Via Wmic
Detects the use of WMIC to add a file path to the Microsoft Defender exclusion list. This specific command structure is a known technique used by the MKDOOR backdoor to evade detection.
YARA-L
Detects the use of WMIC to add a file path to the Microsoft Defender exclusion list. This specific command structure is a known technique used by the MKDOOR backdoor to evade detection.
Already have an account?