PowerShell disabling Windows Defender via Set/Add-MpPreference
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Microsoft Sentinel (KQL)
