Engineering detection around Microsoft Defender

This blogpost reviews Microsoft Defender Antivirus (MDAV) features and common attacker techniques to disable or bypass it (registry and Set-MpPreference changes, Add-MpPreference exclusions, removing signatures via MpCmdRun, stopping Defender services, and AMSI bypasses), and provides Sigma detection rules, example commands, event IDs and notes on false positives and detection efficacy to help defenders monitor and detect tampering and evasion.