PUA - DefenderCheck Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.