Suspicious Windows Defender Registry Modification

sequence by process.entity_id with maxspan=5s
 [registry where
  registry.value :
         ("DisableBehaviorMonitoring",
          "DisableOnAccessProtection",
          "DisableScanOnRealtimeEnable",
          "DisableRealtimeMonitoring",
          "DisableIOAVProtection",
          "DisableRawWriteNotification",
          "DisableScriptScanning",
          "DisableArchiveScanning") and registry.data.strings : "1" and
   (
     /* suspicious paths, common lolbins, unsigned or untrusted file signature */
     process.executable : ("?:\\Users\\*\\AppData\\*", "?:\\Users\\Public\\*", "?:\\Windows\\Microsoft.NET\\*", "?:\\ProgramData\\*") or
     process.name : ("rundll32.exe", "regsvr32.exe", "cscript.exe", "wscript.exe", "mshta.exe", "msbuild.exe", "powershell.exe") or
     process.code_signature.trusted == false or
     process.code_signature.exists == false
   )
   and not process.executable :
             ("?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
              "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
              "*\\Program Files*\\Windows Defender\\MsMpEng.exe",
              "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\ConfigSecurityPolicy.exe")
   ]
   [registry where
    registry.value :
         ("DisableBehaviorMonitoring",
          "DisableOnAccessProtection",
          "DisableScanOnRealtimeEnable",
          "DisableRealtimeMonitoring",
          "DisableIOAVProtection",
          "DisableRawWriteNotification",
          "DisableScriptScanning",
          "DisableArchiveScanning") and registry.data.strings : "1"]