Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration
Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-05
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block content that calls the Remove-MpPreference cmdlet, along with additional Defender-related parameter strings indicating configuration tampering. Attackers may attempt to weaken endpoint protections by modifying Windows Defender settings before or during malicious activity. Telemetry relies on PowerShell Script Block Logging to capture the ScriptBlockText content containing these cmdlet and parameter fragments.
Reporting behind it
- techcommunity.microsoft.comhttps://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration"
id: 26173361-29ea-4535-b4db-5493bc8aeada
related:
- id: 07e3cb2c-0608-410d-be4b-1511cb1a0448
type: similar
- id: ae2bdd58-0681-48ac-be7f-58ab4e593458
type: derived
status: test
description: This rule identifies PowerShell script block content that calls the Remove-MpPreference cmdlet, along with additional Defender-related parameter strings indicating configuration tampering. Attackers may attempt to weaken endpoint protections by modifying Windows Defender settings before or during malicious activity. Telemetry relies on PowerShell Script Block Logging to capture the ScriptBlockText content containing these cmdlet and parameter fragments.
references:
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_remove:
ScriptBlockText|contains: Remove-MpPreference
selection_tamper:
ScriptBlockText|contains:
- "-ControlledFolderAccessProtectedFolders "
- "-AttackSurfaceReductionRules_Ids "
- "-AttackSurfaceReductionRules_Actions "
- "-CheckForSignaturesBeforeRunningScan "
condition: all of selection_*
falsepositives:
- Legitimate PowerShell scripts
level: high
license: DRL-1.1