Rule Info
Name
Suspicious Uninstall of Windows Defender Feature via PowerShell
Author
yxinmiracle
Description
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Date
2025-08-22 00:00:00
Modified
None
Id
c443012c-7928-43bf-ac20-7eda5efe61ad
Tags
attack.defense-evasion attack.t1562.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
YxinMiracle
Merge PR #5619 from @YxinMiracle - Suspicious Uninstall of Windows Defender Feature via PowerShell
2025-10-01
Scan your endpoints, forensic images or collected files with our portable scanner THOR