Suspicious Use of WMIC for Windows Defender Exclusion

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the usage of WMIC to modify Windows Defender's exclusion list. This behavior is potentially suspicious because legitimate administrators typically use PowerShell, the Windows Defender UI, or other authorized methods to configure exclusions. Using WMIC in this way could be an indication of an attempt to bypass security controls or evade detection.

2025-02-13 00:00:00

None

11bd6106-7842-405e-a5c6-524beb205a48

attack.defense-evasion attack.t1562 attack.execution attack.t1059

Nextron Sigma feed only (private)