Defender Control Change Followed by Discovery Cascade
This rule links changes that weaken Windows Defender with a rapid series of network discovery commands. Attackers often turn down protections before mapping the network for ransomware. Treat this sequence as active compromise. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
