Windows PowerShell Uninstall-WindowsFeature/Remove-WindowsFeature Removing Windows-Defender GUI

title: Windows PowerShell Uninstall-WindowsFeature/Remove-WindowsFeature Removing Windows-Defender GUI
id: 631d6e0a-1c94-4652-9cba-c3ab457d5896
status: experimental
description: This rule flags PowerShell execution of Uninstall-WindowsFeature or Remove-WindowsFeature when the command line includes Windows-Defender, indicating an attempt to disable or remove the Windows Defender GUI feature. Attackers may use this defense-impairment behavior to reduce user-visible security controls. Telemetry relies on process creation events capturing the PowerShell image name and the full command line arguments.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.windows.servermanager.migration/uninstall-windowsfeature
  - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_uninstall_defender_feature.yml
author: yxinmiracle, Huntrule Team
date: 2025-08-22
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell_ISE.EXE
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_uninstall:
    CommandLine|contains:
      - Uninstall-WindowsFeature
      - Remove-WindowsFeature
  selection_cli_defender_feature:
    CommandLine|contains: Windows-Defender
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c443012c-7928-43bf-ac20-7eda5efe61ad
    type: derived