SolarWinds Web Help Desk Exploitation - Defender and Firewall Disable

Daniel Jeremiah@daniyyell

•updated Feb 9, 2026•2•0•22

This rule detects attempts to disable Windows Defender and Windows Firewall via registry modifications using the 'reg add' command. Specifically, it looks for command-line arguments that include 'add', 'REG_DWORD', and keywords related to disabling Defender features (DisableAntiSpyware, DisableBehaviorMonitoring, DisableRealTimeMonitoring, DisableOAVProtection) or the 'mpssvc' service, along with setting the value to '4' or '1'. This activity is often associated with malware attempting to evade security controls.