Hola Defender Exclusion Via Powershell Or Mpcmdrun

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•5

This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.