Windows Defender Reconnaissance - PowerShell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to gather detailed information about Windows Defender settings and status using Defender related commands. This behavior may indicate that an attacker is trying to assess the system's security configuration to identify potential weaknesses. Adversaries often perform reconnaissance to enumerate the system's security policies, configurations, and defenses. By understanding the current security posture, attackers can tailor their exploitation strategies to bypass defenses and achieve their objectives.

2025-02-13 00:00:00

None

69e977b0-3480-4ce2-afca-2c9dea270a84

attack.defense-evasion attack.t1562 attack.execution attack.t1059

Nextron Sigma feed only (private)