Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection