HEAVYGRAM PowerShell Defender Exclusion and Registry Persistence

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects a suspicious sequence of PowerShell commands associated with HEAVYGRAM-related droppers. The rule identifies processes that attempt to bypass security protections by adding Windows Defender exclusion paths, followed by registry-based persistence mechanisms (Run keys) that target common malicious executables such as RuntimeSSH.exe or winappx.exe.