Suspicious Uninstall of Windows Defender Feature via PowerShell (c443012c-7928-43bf-ac20-7eda5efe61ad)
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.