Windows Defender Tampering via PowerShell Set-MpPreference
This rule detects attempts to tamper with Windows Defender settings using PowerShell's Set-MpPreference cmdlet. Specifically, it looks for commands that disable various Defender features like real-time monitoring, behavior monitoring, archive scanning, or set default threat actions to 'Allow'. This activity is indicative of an adversary trying to impair defensive capabilities on a system.
Sigma
