PowerShell disables Windows Defender real-time monitoring

Duo Tech@duotech

•updated Jul 13, 2026•22•1•32

Detects the use of PowerShell to execute the 'Set-MpPreference' command with the 'DisableRealtimeMonitoring' parameter set to true. This technique is commonly used by adversaries to impair Windows Defender security controls and avoid detection during the post-compromise phase.