HoneyMyte Disables Microsoft Defender via Altitude Tampering

Tim Peck@timpeck

•updated Dec 29, 2025•12•2•251

Detects the tampering of the Microsoft Defender file system mini-filter driver's 'Altitude' registry value. The HoneyMyte APT's rootkit sets this value to '0' to prevent the driver from loading, effectively impairing system defenses.