Microsoft Defender service components status disabled (Registry via Sysmon)

Detects scenarios where an attacker attempts to disable Defender security features by modifying service configuration in registry.