AA22-264A Windows Defender Feature Disable via Registry Modification

Brandon Rodriguez@BMRodriguez

•updated Apr 6, 2026•18•0•332

Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.