Windows Defender Tamper Protection Disablement Status
Detects when the Tamper Protection feature of Windows Defender is disabled. This action is often taken by adversaries or malicious software to weaken endpoint defenses and facilitate further compromise or concealment of malicious activity.
Microsoft Sentinel (KQL)
