Nightmare Eclipse - Disabling Defender via Add-MpPreference (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•2

Identifies the threat actor executing PowerShell commands to add entire root directories (C:\) to Defender's exclusion list before dropping the ransomware payload.