Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

MosaicLoader

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•0•27

This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection

Microsoft Sentinel (KQL)

Tags

TA0011 - Command and Control TA0005 - Defense Evasion T1562 - Impair Defenses T1480.002 - Mutual Exclusion S0343 - Exaramel for Windows T1543.003 - Windows Service T1060 - Registry Run Keys / Startup Folder T1547.001 - Registry Run Keys / Startup Folder T1165 - Startup Items T1588.001 - Malware T1587.001 - Malware T1608.001 - Upload Malware TA0003 - Persistence TA0004 - Privilege Escalation TA0042 - Resource Development Registry Event Registry Value Set Windows Windows Defender Avkqltactic:Command and control

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?