Windows Defender Disabled via Registry - T1562.001

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.