ToolShell Defender Protection Disablement

R W@shiftyroot

•updated Jul 24, 2025•0•27

This detection identifies attempts to disable or tamper with Microsoft Defender Antivirus using common command-line tools. This is a frequent defense evasion technique used by threat actors, including those exploiting SharePoint vulnerabilities, to operate undetected on a compromised host.