Microsoft Defender Tamper via Suspicious MpCmdRun.exe Invocation

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•2

Detects suspicious execution of MpCmdRun.exe (Windows Defender command-line utility) when it is spawned by an unexpected parent process or executed with arguments commonly used to disable or modify Windows Defender's functionality. This rule aims to identify attempts to impair defenses.