Windows Defender Real-time Protection Disabled

SigmaHQ Detections@sigmaHQ

•updated Dec 21, 2023•0•0•2

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment