Multiple Correlated Defender/SmartScreen Disabling Actions (SMOKE#SCREEN)
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Microsoft Sentinel (KQL)
