Microsoft Defender Disabled via PowerShell, sc.exe, or Registry (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.