Windows Defender Real-Time Protection Tampering Attempt

Ahamed Rizvan@ahamedrizvan

•updated Aug 3, 2025•2•1•57

This rule detects attempts to tamper with Windows Defender's real-time protection settings by monitoring specific registry key modifications. It specifically looks for "TamperingAttempt" actions targeting the 'HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\Real-Time Protection' registry key, which is commonly used to disable or modify Windows Defender's real-time scanning capabilities.