Potential Windows Defender Tampering Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Jun 24, 2026•0•0•5

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic