CmdID

CmdID / PowerShell / Cmdlets / Remove

Remove-MpPreference

Removes exclusions or default actions. Windows Server PowerShell reference

From the Windows Server PowerShell reference 98 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

98 in the Windows Server PowerShell reference
Show its 98 parameters
-AllowDatagramProcessingOnWinServer, -adpowsIndicates that the cmdlet removes whether to disable inspection of UDP connections on Windows Server.
-AllowNetworkProtectionDownLevel, -anpdlIndicates that the cmdlet removes whether to allow network protection to be set to Enabled or Audit Mode on Windows versions before 1709.
-AllowNetworkProtectionOnWinServer, -anpwsIndicates that the cmdlet removes whether to allow network protection to be set to Enabled or Audit Mode for Windows Server.
-AsJobRuns the cmdlet as a background job.
-AttackSurfaceReductionOnlyExclusionsSpecifies the files and paths to exclude from Attack Surface Reduction (ASR) rules.
-AttackSurfaceReductionRules_ActionsSpecifies the states of attack surface reduction rules specified by using the AttackSurfaceReductionRules_Ids parameter.
-AttackSurfaceReductionRules_IdsSpecifies the states of attack surface reduction rules specified by using the AttackSurfaceReductionRules_Ids parameter.
-CheckForSignaturesBeforeRunningScan, -csbrIndicates that the cmdlet removes whether to check for new virus and spyware definitions before Windows Defender runs a scan.
-CimSession, -SessionRuns the cmdlet in a remote session or on a remote computer.
-CloudBlockLevelSpecifies a cloud block level.
-CloudExtendedTimeout, -cloudextimeoutSpecifies the amount of extended time to block a suspicious file and scan it in the cloud.
-ControlledFolderAccessAllowedApplicationsSpecifies applications that can make changes in controlled folders.
-ControlledFolderAccessProtectedFoldersSpecifies more folders to protect.
-DisableArchiveScanning, -darchscIndicates that the cmdlet removes whether to scan archive files, such as .zip and .cab files, for malicious and unwanted software.
-DisableAutoExclusions, -daeIndicates that the cmdlet removes whether to disable the Automatic Exclusions feature for the server.
-DisableBehaviorMonitoring, -dbmIndicates that the cmdlet removes whether to enable behavior monitoring.
-DisableBlockAtFirstSeen, -dbafIndicates that the cmdlet removes whether to enable block at first seen.
-DisableCatchupFullScan, -dcfscIndicates that the cmdlet removes whether Windows Defender runs catch-up scans for scheduled full scans.
-DisableCatchupQuickScan, -dcqscIndicates that the cmdlet removes whether Windows Defender runs catch-up scans for scheduled quick scans.
-DisableCpuThrottleOnIdleScansIndicates that the cmdlet removes whether the CPU will be throttled for scheduled scans while the device is idle.
-DisableDatagramProcessing, -ddtgpIndicates that the cmdlet removes whether to disable inspection of UDP connections.
-DisableDnsOverTcpParsing, -ddnstcppIndicates that the cmdlet removes whether to disable inspection of DNS traffic that occurs over a TCP channel.
-DisableDnsParsing, -ddnspIndicates that the cmdlet removes whether to disable inspection of DNS traffic that occurs over a UDP channel.
-DisableEmailScanning, -demscIndicates that the cmdlet removes whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments.
-DisableGradualRelease, -dgrIndicates that the cmdlet removes whether to disable gradual rollout of monthly and daily Windows Defender updates.
-DisableHttpParsing, -dhttppIndicates that the cmdlet removes whether disable inspection of HTTP traffic.
-DisableInboundConnectionFiltering, -dicfIndicates that the cmdlet removes whether to inspect only outbound connections.
-DisableIntrusionPreventionSystem, -dipsIndicates that the cmdlet removes whether to configure network protection against exploitation of known vulnerabilities.
-DisableIOAVProtection, -dioavpIndicates that the cmdlet removes whether Windows Defender scans all downloaded files and attachments.
-DisablePrivacyMode, -dpmIndicates that the cmdlet removes whether to disable privacy mode.
-DisableRdpParsing, -drdppIndicates that the cmdlet removes whether to inspect only outbound connections.
-DisableRealtimeMonitoring, -drtmIndicates that the cmdlet removes whether to use real-time protection.
-DisableRemovableDriveScanning, -drdscIndicates that the cmdlet removes whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan.
-DisableRestorePoint, -drpIndicates that the cmdlet removes whether to disable scanning of restore points.
-DisableScanningMappedNetworkDrivesForFullScan, -dsmndfscIndicates that the cmdlet removes whether to scan mapped network drives.
-DisableScanningNetworkFiles, -dsnfIndicates that the cmdlet removes whether to scan for network files.
-DisableScriptScanning, -dscrptscIndicates that the cmdlet removes whether to disable the scanning of scripts during malware scans.
-DisableSshParsing, -dsshpIndicates that the cmdlet removes whether to disable inspection of SSH traffic.
-DisableTlsParsing, -dtlspIndicates that the cmdlet removes whether to disable inspection of TLS traffic, also known as HTTPS.
-EnableControlledFolderAccessIndicates that the cmdlet removes the state for the controlled folder access feature.
-EnableDnsSinkhole, -ednssIndicates that the cmdlet removes whether to examine DNS traffic to detect and sinkhole DNS exfiltration attempts and other DNS based malicious attacks.
-EnableFileHashComputation, -efhcIndicates that the cmdlet removes whether to enable file hash computation.
-EnableFullScanOnBatteryPower, -efsobpIndicates that the cmdlet removes whether Windows Defender does a full scan while on battery power.
-EnableLowCpuPriority, -elcpIndicates that the cmdlet removes whether Windows Defender uses low CPU priority for scheduled scans.
-EnableNetworkProtectionSpecifies how the Network Protection Service handles web-based malicious threats, including phishing and malware.
-EngineUpdatesChannel, -erelrSpecifies when devices receive Microsoft Defender engine updates during the monthly gradual rollout.
-ExclusionExtensionSpecifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning.
-ExclusionIpAddressSpecifies an array of IP addresses to exclude from scheduled and real-time scanning.
-ExclusionPathSpecifies an array of file paths to exclude from scheduled and real-time scanning.
-ExclusionProcessSpecifies an array of processes, as paths to process images.
-ForceForces the command to run without asking for user confirmation.
-ForceUseProxyOnly, -fupoRemoves whether to force the device to use only the proxy.
-HighThreatDefaultAction, -htdefacIndicates that this cmdlet removes the automatic remediation action specified for the high threat alert level.
-LowThreatDefaultAction, -ltdefacIndicates that this cmdlet removes the automatic remediation action specified for the low threat alert level.
-MAPSReportingIndicates that the cmdlet removes membership in Microsoft Active Protection Service.
-MeteredConnectionUpdates, -mcupdIndicates that the cmdlet removes whether to update managed devices to update through metered connections.
-ModerateThreatDefaultAction, -mtdefacIndicates that this cmdlet removes the automatic remediation action specified for the moderate threat alert level.
-PlatformUpdatesChannel, -prelrSpecifies when devices receive Microsoft Defender platform updates during the monthly gradual rollout.
-ProxyBypass, -proxbpsSpecifies proxy bypasses.
-ProxyPacUrl, -ppurlSpecifies the Privilege Attribute Certificate (PAC) proxy.
-ProxyServer, -proxsrvSpecifies the proxy server.
-PUAProtectionSpecifies the level of detection for potentially unwanted applications.
-QuarantinePurgeItemsAfterDelay, -qpiadIndicates that the cmdlet removes specified number of days to keep items in the Quarantine folder.
-RandomizeScheduleTaskTimes, -rsttIndicates that the cmdlet removes whether to select a random time for the scheduled start and scheduled update for definitions.
-RealTimeScanDirection, -rtsdIndicates that the cmdlet removes specified scanning configuration for incoming and outgoing files on NTFS volumes.
-RemediationScheduleDay, -rsdIndicates that the cmdlet removes specified day of the week on which to perform a scheduled full scan in order to complete remediation.
-RemediationScheduleTime, -rstIndicates that the cmdlet removes specified time of day, as the number of minutes after midnight, to perform a scheduled scan.
-ReportingAdditionalActionTimeOut, -raatIndicates that the cmdlet removes specified number of minutes before a detection in the additional action state changes to the cleared state.
-ReportingCriticalFailureTimeOut, -rctoIndicates that the cmdlet removes specified the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state.
-ReportingNonCriticalTimeOut, -rnctoIndicates that the cmdlet removes specified number of minutes before a detection in the non-critically failed state changes to the cleared state.
-ScanAvgCPULoadFactor, -saclfIndicates that the cmdlet removes specified maximum percentage CPU usage for a scan.
-ScanOnlyIfIdleEnabled, -soiieIndicates that the cmdlet removes whether to start scheduled scans only when the computer is not in use.
-ScanParametersIndicates that the cmdlet removes specified scan type to use during a scheduled scan.
-ScanPurgeItemsAfterDelay, -spiadIndicates that the cmdlet removes specified number of days to keep items in the scan history folder.
-ScanScheduleDay, -scsdIndicates that the cmdlet removes specified the day of the week on which to perform a scheduled scan.
-ScanScheduleQuickScanTime, -scsqstIndicates that the cmdlet removes specified time of day, as the number of minutes after midnight, to perform a scheduled quick scan.
-ScanScheduleTime, -scstIndicates that the cmdlet removes specified time of day, as the number of minutes after midnight, to perform a scheduled scan.
-SchedulerRandomizationTime, -srtSpecifies the randomization time for the scheduler.
-SevereThreatDefaultAction, -stdefacIndicates that this cmdlet removes the automatic remediation action specified for the severe threat alert level.
-SharedSignaturesPath, -ssp, -SecurityIntelligenceLocation, -sslSpecifies the shared signatures path.
-SignatureAuGracePeriod, -sigagpIndicates that the cmdlet removes specified grace period, in minutes, for the definition.
-SignatureBlobFileSharesSources, -sigbfsSpecifies the file shares sources for signatures.
-SignatureBlobUpdateInterval, -sigbuiIndicates that the cmdlet removes the signature update interval.
-SignatureDefinitionUpdateFileSharesSources, -sigdufssIndicates that the cmdlet removes specified file-share sources for definition updates.
-SignatureDisableUpdateOnStartupWithoutEngine, -sigduoswoIndicates that the cmdlet removes whether to initiate definition updates even if no antimalware engine is present.
-SignatureFallbackOrder, -sfoIndicates that the cmdlet removes specified order in which to contact different definition update sources.
-SignatureFirstAuGracePeriod, -sigfagpIndicates that the cmdlet removes specified grace period, in minutes, for the definition.
-SignatureScheduleDay, -sigsdIndicates that the cmdlet removes specified day of the week on which to check for definition updates.
-SignatureScheduleTime, -sigstIndicates that the cmdlet removes specified time of day, as the number of minutes after midnight, to check for definition updates.
-SignaturesUpdatesChannel, -srelrSpecifies when devices receive daily Microsoft Defender definition updates during the monthly gradual rollout.
-SignatureUpdateCatchupInterval, -siguciIndicates that the cmdlet removes specified number of days after which Windows Defender requires a catch-up definition update.
-SignatureUpdateInterval, -siguiIndicates that the cmdlet removes specified interval at which to check for definition updates.
-SubmitSamplesConsentIndicates that the cmdlet removes how Windows Defender checks for user consent for certain samples.
-ThreatIDDefaultAction_Actions, -tiddefacaSpecifies an array of actions to remove for the threat IDs specified by using the ThreatIDDefaultAction_Ids parameter.
-ThreatIDDefaultAction_Ids, -tiddefaciSpecifies an array of threat IDs.
-ThrottleLimitSpecifies the maximum number of concurrent operations that can be established to run the cmdlet.
-UILockdownIndicates that the cmdlet removes whether to disable UI lockdown mode.
-UnknownThreatDefaultAction, -unktdefacIndicates that this cmdlet removes the automatic remediation action specified for the unknown threat alert level.

What looks for it

Sigma process creation rules that name Remove-MpPreference
highTamper Windows Defender Remove-MpPreferenceNasreddine Bencherchali (Nextron Systems)