AAct sample invokes WMIC to request Defender exclusions for itself and helper paths
A process tree shows an AAct-associated executable launching a command to request a Defender exclusion for its own path. Other records name a directory and several executable or DLL paths, broadening the scope of the request, but do not show that Defender accepted it.
An executable running as program.exe launched a command shell, which in turn launched Windows’ WMIC utility with an unusual request: add the executable’s own path to Microsoft Defender’s exclusions. The process tree makes the question concrete. Was this simply an activation utility trying to avoid detection, or evidence of a broader attempt to protect other components from inspection?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read