Disable Windows Defender Functionalities Via Registry Keys

{
  "registry_set": {
    "EventID": 4657,
    "Channel": "Security"
  },
  "selection_main": {
    "ObjectName
| contains": [
      "\\SOFTWARE\\Microsoft\\Windows Defender\\",
      "\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\",
      "\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\"
    ]
  },
  "selection_dword_1": {
    "ObjectName
| endswith": [
      "\\DisableAntiSpyware",
      "\\DisableAntiVirus",
      "\\DisableBehaviorMonitoring",
      "\\DisableBlockAtFirstSeen",
      "\\DisableEnhancedNotifications",
      "\\DisableIntrusionPreventionSystem",
      "\\DisableIOAVProtection",
      "\\DisableOnAccessProtection",
      "\\DisableRealtimeMonitoring",
      "\\DisableScanOnRealtimeEnable",
      "\\DisableScriptScanning"
    ],
    "NewValue": "DWORD (0x00000001)"
  },
  "selection_dword_0": {
    "ObjectName
| endswith": [
      "\\DisallowExploitProtectionOverride",
      "\\Features\\TamperProtection",
      "\\MpEngine\\MpEnablePus",
      "\\PUAProtection",
      "\\Signature Update\\ForceUpdateFromMU",
      "\\SpyNet\\SpynetReporting",
      "\\SpyNet\\SubmitSamplesConsent",
      "\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess"
    ],
    "NewValue": "DWORD (0x00000000)"
  },
  "filter_optional_symantec": {
    "ProcessName
| startswith": "C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\",
    "ProcessName
| endswith": "\\sepWscSvc64.exe"
  },
  "condition": "registry_set and (selection_main and 1 of selection_dword_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Administrator actions via the Windows Defender interface
• ⚠ Third party Antivirus