Disabling Defender real-time monitoring

evasion_defender_realtime_disable

Attempts to turn off Microsoft Defender's real-time monitoring through Set-MpPreference and turns it back on again. With tamper protection enabled this must fail; if it succeeds, the host can be disarmed by anything running with the same rights.

Severity critical how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 1 Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.
wants admin
Only fully works with administrative rights. It still runs without them — the refusal is itself informative — and the report says which it was.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1562.001	Disable or Modify Tools	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other defence evasion tests

Other tests in the Defence evasion category.
Test	What it does	Severity
Adding a Defender exclusion path evasion_defender_exclusion	Adds the sandbox directory to Microsoft Defender's exclusion list, verifies whether it took effect, and removes it again. Adding an exclusion is how c…	critical
Stopping security services evasion_security_service_stop	Identifies which EDR/AV/telemetry services are actually running on this host and attempts to stop up to three of them, then restarts them. Tamper prot…	critical
In-memory AMSI bypass attempt evasion_amsi_bypass_attempt	Runs the published AMSI bypass one-liner in PowerShell and then feeds AMSI's own test string through Invoke-Expression, to establish whether script sc…	high
Clearing an event log evasion_event_log_clear	Clears the Windows Application event log, which is the anti-forensic step that follows a successful intrusion and raises event 1102. This cannot be un…	high
Disabling the host firewall evasion_firewall_disable	Turns the host firewall off and immediately back on, using the platform's own tool (netsh advfirewall, socketfilterfw, ufw or firewalld). The re-enabl…	high
Timestomping a file evasion_timestomp	Backdates the modification and access times of a sandbox file to 2009 and verifies the change, the standard anti-forensic step for making a dropped fi…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.