IFEO Debugger Value Set on MsMpEng.exe for Defender Hijack
Detects the modification of the Image File Execution Options (IFEO) registry key for the Microsoft Defender service executable (MsMpEng.exe) by setting a 'Debugger' value. This technique is often used to impair security defenses by redirecting or preventing the execution of the Antivirus engine.
Microsoft Sentinel (KQL)
