Bypass Record
Disable or Modify Tools × Microsoft Windows Defender
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Attackers modify registry keys associated with Windows Defender's update service to disable automatic signature updates. This prevents the antivirus from receiving new definitions, allowing malware that would otherwise be detected to execute without interference.
Detection & mitigation
Monitor for registry modifications to Windows Defender update settings (e.g., HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates). Use EDR to alert on changes to security tool configurations and enforce tamper protection.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.