T1562.001 Disable or Modify Tools - Windows Defender Tampering
Threat actors, particularly ransomware operators, are known to attept to disable EDR tooling prior to completing their actions on objectives in order to better carry our their actions uninhibited. Ransomware groups such as The Gentlemen have been observed using PowerShell to disable Microsoft Defender real time protection. * Note if you are standardized on MITRE ATT&CK v19, this is now tracked as T1685.001
Microsoft Sentinel (KQL)
