Defender Tampering - Disable AntiSpyware

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•6

Detects attempts to disable Windows Defender features by modifying specific registry values. This rule looks for changes to registry keys under `\Policies\Microsoft\Windows Defender` where values like `DisableAntiSpyware`, `DisableRealtimeMonitoring`, `DisableBehaviorMonitoring`, or `DisableIOAVProtection` are set to '1', indicating an attempt to disable these security features.