GreenBlood Ransomware - Windows Defender Disabled via Registry (DisableRealtimeMonitoring)
Detects attempts by the GreenBlood ransomware to disable Windows Defender's real-time monitoring by modifying the registry. This rule specifically looks for 'reg.exe' commands that add 'DisableRealtimeMonitoring=1' to the Windows Defender policy key.
Microsoft Sentinel (KQL)
