indicatorregistry_key
HKLM\SOFTWARE\Policies\Microsoft\WindowsDefender
- First seen
- 2026-08-04
- Last seen
- 2026-08-08
- Sightings
- 2
Posts referencing this indicator
- The Gentlemen are knocking: сustom backdoors and evolving tactics
Registry key modified to disable Windows Defender real-time protection. The group sets DisableAntiSpyware, DisableBehaviorMonitoring, DisableOnAccessProtection, and DisableScanOnRealtimeEnable to 1.
- An analysis of incidents at Brazilian educational institutions
Registry key modified by attacker's batch script to disable Windows Defender real-time monitoring, behavior monitoring, and IOAV protection