Disabling Windows Defender via SystemSettingsAdminFlows.exe
Detects the use of the legitimate Windows binary 'SystemSettingsAdminFlows.exe' to spawn a child process that disables Windows Defender settings. This is a LOLBin technique used for defense evasion as observed in campaigns leveraging the Apache ActiveMQ exploit.
Microsoft Sentinel (KQL)
