BYOVD - Registry Tampering of Defender Post-Execution (T1562.001)
Identifies the EDR killer utility actively tampering with the Windows Defender registry keys (DisableAntiSpyware, DisableRealtimeMonitoring) after kernel access is achieved. This rule specifically looks for modifications to the 'DisableAntiSpyware' or 'DisableRealtimeMonitoring' registry values under the Windows Defender policy key, setting them to '1' (enabled/disabled respectively), and correlates this with the loading of a '.sys' driver file by the same initiating process.
Microsoft Sentinel (KQL)
