Disabling Real-time Monitoring via PowerShell

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.