System-PID4 registry tamper on Defender protections or Run/RunOnce keys
Detects System-process (PID 4) registry writes or deletions targeting Windows Defender tamper-protection values or Run/RunOnce persistence keys, indicating use of the BTR.sys kernel registry-write primitive to disable protections or establish persistence.
Microsoft Sentinel (KQL)
