Millenium RAT Windows Defender C:\ Exclusion via Add-MpPreference

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.