PowerShell Adds Windows Defender Exclusion for 10FXRAT Directories

Ethan Andrews@eandrews

•updated Jun 8, 2026•2•0•6

Detects PowerShell commands attempting to add Windows Defender exclusion paths for directories associated with the 10FXRAT malware. This rule specifically looks for the use of 'Add-MpPreference' with '-ExclusionPath' in the command line, combined with the presence of 'AppNetSvc' or 'WinDiagTrack', which are known directories used by 10FXRAT for staging and persistence.