ScreenConnect AsyncRAT Campaign: Defender Exclusions via Add-MpPreference for RegAsm.exe

Ethan Andrews@eandrews

•updated Jul 1, 2026•1•0•3

Detects suspicious PowerShell activity characteristic of the ScreenConnect AsyncRAT campaign, specifically the use of Add-MpPreference to add Windows Defender exclusions for RegAsm.exe and drive roots, and the modification of ConsentPromptBehaviorAdmin to suppress UAC prompts. These actions facilitate process hollowing and malware execution with elevated privileges.