Windows Impair Defense Disable Win Defender Compute File Hashes

This analytic detects modifications to the Windows registry that disable Windows Defender's file hash computation by setting the EnableFileHashComputation value to 0. This can impair Windows Defender's ability to detect and scan for malware, potentially allowing attackers to bypass security controls for undetected malware execution and persistence.