MDI Sensor Deleted

Stanislas MEDRANO@stanfrbd

•updated Oct 28, 2025•15•0•218

This rule detects when an MDI (Microsoft Defender for Identity) sensor is deleted. This could indicate an adversary attempting to impair defenses by removing security monitoring tools.