Windows Defender Disabled via Registry Modification

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to disable Windows Defender via a registry modification, specifically looking for the string "DisableAntiSpyware" in HTTP client body traffic. This activity is often associated with malware or adversary actions to evade defense mechanisms.