Ransomware Series: Nova/Gentlemen Ransomware Defender Bulk-Disable via Set-MpPre

Ibrahim Saud@tektrix

•updated 11 days ago•2•0•1

Detects the use of PowerShell Set-MpPreference commands to disable multiple Microsoft Defender security features, including real-time monitoring, behavioral scanning, and threat detection actions. This activity is consistent with ransomware behavior, such as Nova or The Gentlemen families, attempting to neutralize endpoint protection before proceeding with malicious actions like file encryption.