Powershell Remove Windows Defender Directory

This analytic detects suspicious PowerShell commands that attempt to delete the Windows Defender directory. It specifically looks for PowerShell Script Block Logging (EventCode 4104) entries containing "rmdir" and targeting paths related to "\Microsoft\Windows Defender". Such activity is critical as it suggests an adversary is trying to disable or corrupt Windows Defender, which is a key security component. If successful, this could allow an attacker to bypass endpoint protection and facilitate further malicious activities without detection.