Intune/intune/Externally Sourced Remediations/MicrosoftDefenderAV/Get-RealTimeBehaviour/Detect_RealTimeBehavior.ps1

if((Get-MpComputerStatus).BehaviorMonitorEnabled  -eq "True") {
    Write-Output "Device Compliant"
    exit 0
} else {
    Write-Output "Device Non-Compliant"
    exit 1
}