Defender Tampering - Stop WinDefend Service

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•11

Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.