Defender Exclusion Added via Registry by Non-Defender Process
Detects modifications to Windows Defender registry keys responsible for defining file, path, process, or extension exclusions. Adversaries often modify these settings to prevent security software from scanning their malicious artifacts.
Microsoft Sentinel (KQL)
