Bypass Record
Disable or Modify Tools × Microsoft Defender Antivirus
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Defender Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Using the App Control Policy Wizard, an administrator creates a custom WDAC deny rule targeting MsMpEng.exe. The generated policy files are placed in C:\Windows\System32\CodeIntegrity, and after reboot, Defender real-time monitoring is disabled because WDAC blocks the Defender service executable.
Detection & mitigation
Monitor for creation or modification of WDAC policy files in C:\Windows\System32\CodeIntegrity\, especially those containing deny rules for security products like MsMpEng.exe. Enforce tamper protection and restrict local admin privileges to prevent unauthorized policy changes.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.