Windows Defender Tampering Via Powershell
Detects attempts to tamper with Windows Defender settings using PowerShell. This includes adding exclusions for paths/extensions or disabling real-time monitoring, which are techniques used by malware like the PHALT#BLYX campaign to evade detection.
YARA-L
