Windows Defender Threat Detection Service Stopped

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects when the 'Windows Defender Threat Protection' service is disabled or stopped. This event is triggered when the service state changes to stopped, which could indicate an attempt to impair defenses.