Windows Defender Exclusion Evasion (AsyncRAT)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•5•1•110

This rule detects attempts to evade Windows Defender by adding exclusion paths or processes using PowerShell's Add-MpPreference cmdlet. Specifically, it looks for commands that attempt to exclude 'C:\' or 'powershell.exe', a technique known to be leveraged by AsyncRAT.