SloppyRAT Defender Tampering via WMI MSFT_MpPreference

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects the invocation of common command-line interpreters (PowerShell or Windows Command Shell) via process creation events. This is a broad detection for administrative shell activity, which may also indicate malicious script execution or manual adversary interaction.