Millenium RAT Defense Evasion: Defender Disable, Exclusion Add, Log Clear
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Microsoft Sentinel (KQL)
