Windows Defender Definition Files Removed
This rule detects attempts to remove Windows Defender definition files using the MpCmdRun.exe utility with the '-RemoveDefinitions -All' command-line arguments. This action is typically performed by adversaries to disable or impair Windows Defender's ability to detect malicious software, thereby facilitating their activities and avoiding detection.
Sigma
