SloppyRAT WMI-based Defender status query/config tampering

Ibrahim Saud@tektrix

•updated Sep 19, 2026•1•0•7

Detects attempts to modify, disable, or query Microsoft Defender configuration settings or status using legitimate Windows management tools (PowerShell/WMI) by processes other than authorized Defender executables (MsMpEng.exe, MpCmdRun.exe).