Windows Defender Exclusion Added Via WMIC

Tim Peck@timpeck

•updated Feb 2, 2026•4•0•108

Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to add an exclusion (Path, Process, or Extension) to Microsoft Defender. This technique is used by malware, such as the MKDOOR backdoor, to prevent detection by security products.