Set-MpPreference Mass Defender Disable: 2+ Flags in 30s Window

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.