Windows Defender Configuration Tampering via Remove-MpPreference
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
Sigma
