FTK Imager Used to Remove Microsoft Defender Exclusions (STAC3725)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of FTK Imager (FTKImager.exe), a forensic imaging tool that can be used by adversaries to perform data collection, including capturing physical memory, logical drives, or disk images from a local system.