SimpleHelp - Disabling Defender via Registry (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Hunts for SimpleHelp executing reg.exe commands to disable Windows Defender components (DisableRealtimeMonitoring, DisableAntiSpyware) prior to encryption.