PowerShell Adding Defender Exclusion for ValleyRAT

Ethan Andrews@eandrews

•updated Feb 23, 2026•3•0•54

This rule detects PowerShell being used to add Windows Defender exclusions for file paths and processes associated with the ValleyRAT malware campaign. Specifically, it looks for `Add-MpPreference` command-line arguments that include `-ExclusionPath` with "trvePath" or `-ExclusionProcess` with "WavesSvc64.exe".