LoaderClient/WeedHack Defender Exclusion Path Manipulation T1562.001

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.