Prometei Microsoft Defender Exclusion Activity

Ethan Andrews@eandrews

•updated Feb 28, 2026•10•0•70

Detects PowerShell commands used by Prometei to add Microsoft Defender exclusions for its staging and configuration directories ('C:\Windows\Dell' or 'Intel\Support'). This is a common defense evasion tactic.