also to add, matches these too:
Matches rule Powershell Defender Disable Scan Feature by Florian Roth (Nextron Systems) at Sigma Integrated Rule Set (GitHub)
Detects requests to disable Microsoft Defender features using PowerShell commands
Matches rule Windows Defender Definition Files Removed by frack113 at Sigma Integrated Rule Set (GitHub)
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Matches rule Tamper Windows Defender - ScriptBlockLogging by frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) at Sigma Integrated Rule Set (GitHub).
Matches rule Powershell Defender Exclusion by Florian Roth (Nextron Systems) at Sigma Integrated Rule Set (GitHub)
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Matches rule Windows Defender Exclusions Added - PowerShell by Tim Rauch, Elastic (idea) at Sigma Integrated Rule Set (GitHub)
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Matches rule Non Interactive PowerShell Process Spawned by Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements) at Sigma Integrated Rule Set (GitHub)
Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.
source:virustotal and anyrun