Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•22

Detects the usage of "reg.exe" to tamper with various Windows Defender registry keys. This tampering aims to disable important features related to protection and detection, such as real-time monitoring, cloud protection, tamper protection, and other security functionalities. The rule specifically looks for `reg.exe` commands adding or modifying DWORD values to '0' or '1' for known Windows Defender settings.