Powershell Base64 Encoded MpPreference Cmdlet Usage
Detects base64 encoded PowerShell commands that use 'Add-MpPreference' or 'Set-MpPreference' cmdlets to modify or tamper with Windows Defender Antivirus settings. This is a common technique used by adversaries to disable or reduce the effectiveness of endpoint security solutions.
Sigma
