Registry Modification Disabling Defender or Enabling IFEO/WDigest Credential Caching

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

This rule detects modifications to critical Windows registry keys associated with disabling security features (Microsoft Defender, WDigest credential storage) or establishing persistence via Image File Execution Options (IFEO). These modifications are often performed by adversaries to impair defensive monitoring, bypass credential protections, or execute malicious code when specific processes start.