Tamper Windows Defender - ScriptBlockLogging

SigmaHQ Detections@sigmaHQ

•updated Jan 2, 2024•0•0•4

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.