Defender Exclusion Added via WMIC or PowerShell Targeting Staging Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the addition of Microsoft Defender exclusions (Path, Extension, or Process) via WMIC or PowerShell, followed by a file creation event within a suspicious directory (e.g., Temp, AppData, ProgramData) within 15 minutes. This behavior is indicative of an adversary attempting to bypass antivirus detection for malicious payloads.