Windows Defender Tampering via PowerShell

Mehulkumar Savajani@Msavajani

•updated Jan 7, 2026•76•2•618

Detects PowerShell commands used to add exclusions to Windows Defender or disable real-time monitoring. This is a known defense evasion technique (T1562.001) used by adversaries, including the PHALT#BLYX campaign, to allow malicious components to operate without being detected.