Disable Windows Defender AV Security Monitoring

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to disable Windows Defender's security monitoring features using PowerShell or the 'sc.exe' utility. Specifically, it looks for PowerShell commands that include '-DisableBehaviorMonitoring $true' or '-DisableRuntimeMonitoring $true'. It also identifies 'sc.exe' commands used to stop, delete, or disable the 'WinDefend' service (Windows Defender Antivirus Service). This activity is indicative of an adversary trying to impair defenses to avoid detection.