Defender/EDR tampering via Set-MpPreference, sc.exe, policy registry keys
Detects attempts to tamper with Microsoft Defender services, features, configurations, exclusions, and policy registry keys over a 30-minute aggregation window per device. High-confidence events include stopping Defender services or disabling real-time protection via commands or tampering events, while multiple lower-confidence events (such as adding exclusions or disabling cloud protection) combined together also trigger an alert.
Microsoft Sentinel (KQL)
