• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Multi-method Defender exclusion abuse to whitelist C: drive

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated 25 days ago•1•0•6

    Detects attempts to impair or disable Microsoft Defender Antivirus through unauthorized exclusion paths, Registry modifications, tampering with protection settings, or forcing policy updates.

    SentinelOne

    Tags

    T1685 - Disable or Modify ToolsProcess CreationCommand ExecutionPowershell Script ExecutionRegistry Value ModificationScheduled Task CreatedAntivirus DetectionWindowsWindows Defender AvWindows Eventlog PowershellWindows Task Scheduler Service

    Found in

    • Operation CameraSwarm: 14,000+ Dahua Cameras CompromisedLast updated 26 days ago
    • Operation CameraSwarm: 14,000+ Dahua Cameras CompromisedLast updated 26 days ago
    • Operation CameraSwarm: 14,000+ Dahua Cameras CompromisedLast updated 26 days ago
    • Operation CameraSwarm: 14,000+ Dahua Cameras CompromisedLast updated 26 days ago
    • Operation CameraSwarm: 14,000+ Dahua Cameras CompromisedLast updated 26 days ago
    • Operation CameraSwarm: 14,000+ Dahua Cameras Compromised via P2P and ExploitsLast updated Sep 6, 2026
    • Operation CameraSwarm: 14,000+ Dahua Cameras Compromised via P2P and ExploitsLast updated Sep 6, 2026
    • Operation CameraSwarm: Mass Exploitation of Dahua IoT DevicesLast updated Sep 6, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?