Microsoft Defender Tamper Protection State Modification
Detects unauthorized attempts to modify Microsoft Defender Tamper Protection registry keys. The rule correlates registry value changes from '5' (Enabled) to '0' or '4' (Disabled) against Microsoft Defender Antivirus Troubleshooting Mode events to distinguish between legitimate administrative troubleshooting and potentially suspicious local tampering.
Microsoft Sentinel (KQL)
