Windows Defender Disabled via Registry or PowerShell (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.