Security Tool Tampering

Detects attempts to disable Windows Defender, the firewall, or security services — often a pre-ransomware or persistence step.