Tamper Windows Defender - ScriptBlockLogging

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•12

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. This rule specifically looks for the `Set-MpPreference` cmdlet combined with various parameters that disable Defender features or set threat actions to 'Allow'.