PowerShell Disabling of Windows Defender

Ethan Andrews@eandrews

•updated Feb 27, 2026•28•3•634

Detects the use of PowerShell to disable or weaken Microsoft Defender security features. This technique is commonly used by malware to evade detection before executing malicious payloads, as seen in the referenced Fortinet report.