Microsoft Defender Disabled Shortly After First Login on New VM

Ibrahim Saud@tektrix

•updated Jun 30, 2026•9•0•6

Detects the execution of commands to disable Microsoft Defender (specifically Set-MpPreference or stopping the WinDefend service) within 10 minutes of the first interactive user login on a host. This behavior is indicative of threat actors, such as Akira ransomware affiliates, performing anti-forensics and disabling security controls on newly provisioned or compromised systems.