Gryxa guard: Defender tamper followed by security agent silent uninstall
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Microsoft Sentinel (KQL)
