Microsoft Defender Disabled via Set-MpPreference, sc.exe or Registry Policy Key

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects attempts to disable Microsoft Defender security features. The rule monitors for PowerShell cmdlets (Set-MpPreference), service control operations (sc.exe stopping WinDefend), and registry modifications to the 'DisableAntiSpyware' policy key, which are common methods used by adversaries to impair host-based security defenses.