InsomniaRAT: PowerShell disables Defender and excludes C:\ drive (t.ps1)

Arnold Chan@slaz

•updated 29 days ago•0•0•0

This rule detects the use of PowerShell to modify Microsoft Defender settings to disable real-time, behavior, and IOAV protection, while simultaneously adding a full-drive exclusion for the root directory (C:\). This behavior is characteristic of an adversary attempting to disable security monitoring to facilitate further malicious activity or avoid detection.