Detection rules › By eventPowerShell event 6001 detection rule reference this event. View event page.Sigma (1)Tamper Windows Defender - PSClassic severity high T1562.001