Windows Defender exclusion or security service tampering commands

Ethan Andrews@eandrews

•updated Jul 7, 2026•18•0•16

Detects attempts to tamper with Windows security services and configurations. The rule identifies PowerShell commands used to add Windows Defender exclusions or disable real-time protection, as well as command-line utilities like sc.exe and net.exe used to stop security, antivirus, or EDR services. This behavior is indicative of defense evasion.