Rule name: "Skopnix: Microsoft Defender protection disabled via Set-MpPreference (T1685)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process CommandLine" ILIKE '%set-mppreference%' AND ("Process CommandLine" ILIKE '%disablerealtimemonitoring%' OR "Process CommandLine" ILIKE '%disablebehaviormonitoring%' OR "Process CommandLine" ILIKE '%disableioavprotection%' OR "Process CommandLine" ILIKE '%disablescriptscanning%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1685".
FP-safety: Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.