Suspicious Uninstall of Windows Defender Feature via PowerShell — Detection Rule
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.