Tag
Windows Defender Throttle Rate Modification
2 rules 1 TTPAn attacker modifies the Windows Defender ThrottleDetectionEventsRate registry setting to reduce the frequency of logged detection events, potentially evading detection.
Windows Defender Exclusion Registry Modification
2 rules 1 TTPAdversaries modify Windows Defender exclusion registry entries to bypass antivirus and execute malicious code undetected, potentially leading to persistence and further malicious activities.
Windows Defender BlockAtFirstSeen Feature Disabled via Registry Modification
2 rulesAn attacker modifies the Windows Registry to disable the Windows Defender BlockAtFirstSeen feature, potentially allowing malware to bypass initial detection and increasing the risk of system compromise.
Windows Defender Health Check Interval Modification
2 rulesThis analytic detects modifications to the Windows registry, specifically targeting the `ServiceKeepAlive` value, to impair Windows Defender's ability to perform timely health checks, potentially leading to a vulnerable system state.