HoneyMyte - Defender Exclusion via WMIC MSFT_MpPreference
Detects use of wmic to add Microsoft Defender scan exclusions via the MSFT_MpPreference WMI class, targeting a program-files path and executable named to impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender" directory, excluding both the folder and the renamed sideloader defender.exe from scanning.
YARA-L
