All Detections

Windows Defender Real-Time Protection Disabled via Registry

avatar
nomit vyas@xoxo
updated Jun 25, 2026107

Detects attempts to disable Windows Defender real-time protection by modifying the DisableRealtimeMonitoring registry key using the reg.exe utility.

Microsoft Sentinel (KQL)