ClickFix Defender Tampering via Add-MpPreference/DisableRealtimeMonitoring

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•2

Detects attempts to tamper with Windows Defender configuration using PowerShell cmdlets 'Add-MpPreference' to add exclusions or 'Set-MpPreference' to disable real-time monitoring. This behavior is consistent with ClickFix attack techniques intended to evade endpoint security defenses.