Microsoft Defender service deactivation attempt (command)

Detects scenarios where an attacker attempts to disable Defender security service. If tamper protection is enabled, this action may not work.