Suspicious Uninstall of Windows Defender Feature via PowerShell

Title: Suspicious Uninstall of Windows Defender Feature via PowerShell
Status: experimental
Description:Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
References:
  -https://learn.microsoft.com/en-us/powershell/module/microsoft.windows.servermanager.migration/uninstall-windowsfeature
  -https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
Author: yxinmiracle
Date: 2025-08-22
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell_ise.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'PowerShell_ISE.EXE'
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_cli_uninstall:
    CommandLine|contains:
      -'Uninstall-WindowsFeature'
      -'Remove-WindowsFeature'

  selection_cli_defender_feature:
    CommandLine|contains: 'Windows-Defender'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high