Windows Defender Disabled via Registry, PowerShell or Service Stop (SafePay)
Detects attempts to disable or tamper with Windows Defender settings, services, or registry keys via command-line execution (such as reg.exe, PowerShell, or sc.exe) or direct registry modifications.
Microsoft Sentinel (KQL)
