Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Drops file in Drivers directory

Manipulates Digital Signatures

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Possible privilege escalation attempt