Windows Defender Real-Time Monitoring Disabled Via Registry
Detects attempts to disable Windows Defender's real-time monitoring feature by modifying its corresponding registry key. This technique is commonly used by malware, such as FormBook RAT, to evade detection.
Sigma
