Millenium RAT Disabling Defender via Add-MpPreference ExclusionPath C:\

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the use of PowerShell to modify Microsoft Defender preferences by adding an exclusion path. This activity is commonly used by adversaries to prevent security software from scanning specific directories where malicious tools or payloads are staged.