Disable Windows Defender Functionalities Via Registry Keys

SigmaHQ Detections@sigmaHQ

•updated Oct 8, 2024•1•0•25

Detects when attackers or tools disable Windows Defender functionalities by modifying specific registry keys. This rule looks for changes to various Windows Defender related registry paths, specifically setting DWORD values to either 0x00000001 (to disable certain features) or 0x00000000 (to disable other features like Tamper Protection or PUA Protection).