Millenium RAT Add-MpPreference C:\ Drive Exclusion via PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the use of PowerShell commands 'Add-MpPreference' or 'Set-MpPreference' to add the entire C drive as an exclusion path for Windows Defender. This is a common technique used by attackers to disable security monitoring for the entire file system.