Windows Defender Real-Time Protection Disabled or Exclusions Added via PowerShell

Duo Tech@duotech

•updated Jul 23, 2026•11•0•11

Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.