Defender Control (sordum) disabling Windows Defender
Detects attempts to disable Windows Defender by either executing known Defender Control utilities or by modifying registry keys associated with the disabling of anti-spyware features or the WinDefend service startup.
Microsoft Sentinel (KQL)
