Defender Exclusion Added via WMI

Ethan Andrews@eandrews

•updated Feb 12, 2026•19•0•130

This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware like MKDOOR to prevent detection.