Disabling EDR Real-Time Protection via PowerShell

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•7

This rule detects attempts to disable Microsoft Defender's real-time monitoring or behavior monitoring features using PowerShell. It specifically looks for `powershell.exe` executing `Set-MpPreference` with the `-DisableRealtimeMonitoring` or `-DisableBehaviorMonitoring` parameters set to `1`, `$true`, or `True`.