Disabling Microsoft Defender

Once an attacker has administrative control of a Windows host, disabling Microsoft Defender Antivirus is a standard defense-evasion step (MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools). The canonical one-liner:

Set-MpPreference -DisableRealtimeMonitoring $true

Set-MpPreference is the PowerShell configuration cmdlet for Defender’s preferences; -DisableRealtimeMonitoring (alias drtm) toggles real-time protection. Per Microsoft Learn, this change only succeeds when Tamper Protection is disabled — which is the whole point of Tamper Protection as a control.

Tamper Protection changes the game

Modern Defender (Windows 10 1903+, all supported servers with Defender for Endpoint) ships with Tamper Protection, which blocks changes to security-critical settings — real-time protection, behavior monitoring, cloud protection, exclusions — even from local admins making changes outside sanctioned management channels (Intune, MDE portal, Configuration Manager). Consequences:

• Set-MpPreference -DisableRealtimeMonitoring $true may appear to succeed but is silently ignored.
• Set-MpPreference -DisableTamperProtection $true is reserved for internal Microsoft use and only honored during troubleshooting mode initiated from the Defender portal.
• Group Policy changes to tamper-protected settings are likewise ignored.

Check state before/after with Get-MpComputerStatus (IsTamperProtected, RealTimeProtectionEnabled).

Alternatives attackers use instead

Since outright disabling is often blocked, operators shift to quieter modifications — all still T1562.001:

• Add exclusions instead of disabling: Set-MpPreference -ExclusionPath 'C:\Temp' (also blocked by Tamper Protection when exclusions are protected, but frequently left open).
• Land in Defender’s blind spots: historically, certain directories such as C:\Users\Public have been treated as low-risk staging areas; automatic exclusions also exist for some roles (e.g. Hyper-V, SQL Server). Operating out of excluded paths avoids touching Defender config at all.
• AMSI patching / bypass — neuter script scanning in-process rather than turning the AV off; see amsi-bypass.

Detection

Signal	Notes
Defender Event 5007	Configuration change — logged even when Tamper Protection blocks the change
Get-MpPreference/Set-MpPreference in process command lines	Sysmon EID 1; rare outside admin tooling
RealTimeProtectionEnabled flipping to false	Health-state monitoring via Get-MpComputerStatus / WMI MSFT_MpComputerStatus
New exclusion paths	EID 5007 with exclusion payloads; review against baseline

Related

• amsi-bypass — in-process neutering of script scanning, no admin required
• powershell-execution-policy-bypass — neighboring layer of the same defense stack
• powershell-constrained-language-mode — another control attackers must work around
• windows-reconnaissance-commands — checking Defender service state during situational awareness

Sources

• Set-MpPreference (Defender) | Microsoft Learn
• Protect security settings with tamper protection — Microsoft Defender for Endpoint | Microsoft Learn
• MITRE ATT&CK — Impair Defenses: Disable or Modify Tools (formerly T1562.001, now T1685)