Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•3

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.