Microsoft Defender Tamper via Registry or MpCmdRun Abuse - CVE-2026-45498

nomit vyas@xoxo

•updated Jun 25, 2026•2•0•7

Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.