Windows Defender Real-time Monitoring Disabled
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
Microsoft Sentinel (KQL)
