Windows Defender Real-Time Monitoring Disabled via PowerShell

Bryant Smith@flowstate

•updated Apr 21, 2026•12•1•1,474

Detects the execution of the Set-MpPreference PowerShell cmdlet to disable Windows Defender real-time monitoring. This technique is frequently abused by malware and ransomware affiliates, such as The Gentlemen RaaS, to bypass endpoint defenses prior to payload detonation.