Millenium RAT RCDATA config runtime decode followed by Defender exclusion init_cmd

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.