7 published detections cite this
Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Microsoft Windows Defender Tampering | Medium |
| Service Control Spawned via Script Interpreter | Low |
| Local Scheduled Task Creation | Low |
| Process Execution from an Unusual Directory | Medium |
| Disabling Windows Defender Security Settings via PowerShell | Medium |
| Windows Defender Exclusions Added via PowerShell | Medium |
| Clearing Windows Event Logs | Low |
Showing 7 of 7