Security Service Disabled Via Reg.EXE — Detection Rule

Detects execution of "reg.exe" to disable security services such as Windows Defender.

Read the full analysis on IntelFusions